3. Connect the network to Warda

As long as the router gives its own DNS servers, devices do not go through Warda.

1. Fixed address. In the interface of your router, DHCP section, reserve an address for the Warda box (often called "static lease" or "reservation").
2. Try on one device. In the network settings of one device only (Wi-Fi of a phone, network card of a PC), set the address of Warda as DNS. Browse for a few minutes: ads disappear and the device shows in Devices.
3. The whole network. When all is well, set the address of Warda as the DNS server in the DHCP of the router. Devices take it at their next connection (if needed, turn Wi-Fi off and on).

The assistant recognises the internet boxes of the main providers of the European Union, the United Kingdom, Switzerland and Norway (Freebox, Livebox, SFR Box, Bbox, Proximus, KPN, Ziggo, Speedport, Vodafone, FRITZ!Box, TIM, Movistar, MEO, Swisscom, BT, Sky, Starlink… 45 boxes), and the routers bought for the home, mesh systems included (TP-Link Deco and Archer, Netgear Orbi and Nighthawk, ASUS, Linksys Velop, Google Nest Wifi, eero, UniFi, MikroTik, OpenWrt, pfSense, OPNsense, Synology, FRITZ!Box…). It gives the steps for yours; you find them again in Network → Network analysis, How do I connect the network to Warda?, with the other routers found on the network.

• Your own router behind the box (two routers one behind the other, "double NAT"): Warda works this way. The page shows the box behind the router and says where to put Warda as DNS server: in the router the devices connect to, not in the box.
• A router that answers the devices itself (eero, Google Nest Wifi, Netgear Orbi, AmpliFi): its DNS setting only chooses the server it asks. Put Warda there: the network is protected, but Warda sees every device as the router. To tell them apart, let Warda give the addresses (below).
• A box that does not let you change the DNS (Livebox in France, SFR Box, Speedport, Vodafone Station in Germany, Ziggo, Virgin Media, BT, Sky, Starlink): let Warda give the addresses of the network itself (Let Warda give the addresses of the network (DHCP) in the assistant). It fixes its own address, you turn the DHCP server of the box off, and Warda checks that no other one answers before it starts.

If the box also announces a DNS server over IPv6, Warda warns you: the devices may go around Warda. The fix is the same as in IPv4: have the box announce Warda as its IPv6 DNS server, in place of its own. Warda can also announce itself as DNS server over IPv6 (Network → DNS services), but the devices then keep the server of the box beside it. Cutting IPv6 is only the last resort: it takes IPv6 away from the whole network. The method, step by step: chapter 10.

In Network → Network analysis, Scan the network lists every machine of the network and shows which ones already use Warda (Warda also scans every night). You can give them to a person or a group even before they use Warda. The same page says whether the box is plugged into a managed switch: such a switch announces itself (LLDP or CDP) with the port of the box and its VLAN; an unmanaged switch says nothing.

The devices have a local name, those that get their address from Warda first, then the machines found on the network, for example tv-livingroom.home.lan, and the interface also answers at warda.home.lan. The domain is chosen from the language at installation (home.lan in English, maison.lan in French) and changed in Network → Local DNS. From Warda 0.7.10 the domain is yours to choose: any domain name of two words or more (home.lan, home.arpa, lab.internal, myfamily.local, a domain you own). Two warnings may show under the field, and neither stops you:

• .local is also the domain of mDNS/Bonjour: Apple devices, Avahi (Linux) and some Windows services first look these names up on the network by themselves, so the names of this domain may answer slowly, or not at all, on those devices;
• if the domain exists on the Internet, your devices no longer reach it there: Warda answers its names itself, with the names of your network only. For a name of that domain you need from the Internet (the site of your company), add it on the same page, in Records of the local DNS, with its public address.

Whatever the domain, the names under it never leave your network. The same page takes names of your own (a NAS, a lab): an address (A, AAAA), another name (CNAME) or a text (TXT).

Network proxy (WPAD), at the bottom of Local DNS, is for a network that runs its own proxy (a business filter, a cache): give its name or address and its port, and the devices that detect a proxy automatically use it (local sites and networks stay direct; add exceptions if needed). It is off by default and should stay so otherwise: pointing all the devices to a proxy is a classic way to spy on a network. It works best with Warda on port 80 (the page warns otherwise).

Encrypted DNS. In Network → DNS services, Get the certificate with a name given by Warda (nothing to set up, free, renewed by itself): the phones keep their "private DNS" and still go through Warda. Android: Private DNS, with the name shown; iPhone and Mac: the profile to download; Windows and the browsers: the DoH address shown. The same page tells which upstream servers validate DNSSEC. Only at home: Android keeps its private DNS everywhere, so outside, a phone set to this name gets no names at all; use it for the devices that stay home, or set the phone back to Automatic before leaving. For a device that leaves the house, the protection outside the home gives it an address of its own that works everywhere (chapter 11). Each device, step by step: chapter 9.

The interface in HTTPS, by itself (from Warda 0.7.10). As long as the box has no name, http://warda leads to https://warda, with the certificate Warda made for itself, to accept in the browser. Once the installation is finished and the certificate above is there (one the browsers trust), http://warda leads to https:// followed by the name of the box, with no warning. Nothing to set: Warda checks the conditions all the time, and if one stops holding (the certificate ended, the name lost), it goes back by itself to the address typed. You are never locked out.

• What the devices of the network need over HTTP is never redirected: the page where a child asks for more time, the automatic proxy configuration, the checks of the box.
• If you type the address of the box (http://192.168.1.2) instead of http://warda, you are sent to the name only when your device asked Warda its names over the last 24 hours. Another device stays at the address typed: it would not find the name, which only Warda answers.
• Devices behind another router (or Warda in Docker on a bridge network) reach Warda from one single address: if one of them used the DNS of Warda over the last 24 hours, all of them are sent to the name when they type the address of the box. One whose DNS is not Warda cannot open the name: https:// followed by the address of the box still works, and the command below is the way out.
• After the first redirection to the name, the browser asks you to sign in once more: a session belongs to the address typed.
• In Network → DNS services, the card of the certificate says where things stand, on the line Interface over HTTP: "HTTP redirects to https://…", or "HTTP does not redirect to this name:" with the reason. The line shows once a certificate exists; before that, the command sudo warda https-redirect tells the reason.
• If a browser cannot reach the name (a browser with its own secure DNS, a device whose DNS is not Warda), turn the redirection off on the box: sudo warda https-redirect off (on turns it back on; without a word after it, the command tells the state and why).

Check the signatures in Warda itself, on the same page, is off by default. Warda then checks the DNSSEC signatures itself, starting from the root: an answer changed on the way is refused. If the upstream servers remove the signatures, the page says so and the answers pass as before. Do not turn it on with an upstream server that filters (Quad9, AdGuard, NextDNS, Cloudflare 1.1.1.2 or 1.1.1.3): its blocks of signed names would become failures.

Under Answers, Answer to a blocked name chooses what a device gets for a blocked name: Block page: the address of Warda, which tells why (recommended), Null address 0.0.0.0 / ::, NXDOMAIN: the name does not exist or REFUSED: the query is refused. Choose REFUSED only when Warda is the only DNS server of the devices: most devices then ask their other DNS server, if they have one. Queries per second for each device (0: no limit) stops a device that asks too much; leave 0 when the router sends Warda the queries of the whole network (Warda then sees only one device).

The block page shows the people a page that says why a site is blocked (chapter 5, "The page Blocked by Warda"). From 0.8.4 it is the default: a box where nobody chose an answer uses it, and a box where an answer was chosen keeps it. When Warda cannot show the page (its web interface is not on the ports 80 and 443, or its certificate authority could not be made), the default stays the null address and the page says why.

The DHCP server of Warda#

Network → DHCP server (called DHCP up to Warda 0.8.4) is the page of the addresses Warda gives when it replaces the DHCP server of your box. It is off by default: Turn on… (or the assistant, Let Warda give the addresses of the network (DHCP)) checks that the address of Warda is fixed, asks you to turn the DHCP server of the box off, checks that no other server answers, then starts it (Check and turn the DHCP of Warda on). The page then shows:

• the state of the server and its figures, and the Settings of the DHCP server: the network, the gateway (the box), the DNS server (Warda), the local domain, the First address and Last address of the range (inside the network, never the address of Warda nor of the box), the Lease duration (1 hour to 7 days). Saving restarts Warda for a few seconds; the devices keep their addresses;
• the Options given to the devices: the time servers and the domains searched;
• Give IPv6 addresses (DHCPv6): off by default; Android never asks it and keeps its automatic address;
• the Addresses given (IPv4 and IPv6, refreshed every 15 seconds), with Reserve on each row: a device with a Reserved address always gets the same addresses, and no other device gets them.

When another DHCP server answers on the network, Warda gives no address while it does, and the page says so. To stop, Turn off, after turning the DHCP server of the box on again: otherwise new devices get no address (the others keep theirs for a day).