12. Misuse: what Warda prevents, and its limits

What Warda prevents#

• Being used against others. Warda answers only the devices of your network. A request from the Internet gets no answer, even through a port forwarded on your router. From Warda 0.8.0, a request that comes from the Internet through a reverse proxy or a tunnel (Traefik, nginx, Caddy, Cloudflare Tunnel…) is refused too.
• Its tools used as a weapon. Ping, traceroute, the port test and the tests of a SIEM or of a directory are for administrators only, one at a time and 30 a minute at most, and each one is written in the activity log.
• A saved password sent elsewhere. With Warda Business, the password of the company directory is asked again when its server or its encryption changes.
• A member who wants more rights, or a child who wants to go around the rules. A member cannot give themselves rights; Something is broken never opens adult content nor the hours of a child; VPNs, proxies and encrypted DNS are blocked for minors and reported.
• An adult reading another adult's browsing. The names an adult visits are shown to nobody else unless that adult agrees.
• A DNS port opened on your router, unnoticed. From Warda 0.8.0 the check of the exposure on the Internet (chapter 5) also tries ports 53 and 853, and reports them as critical (over TCP: a forwarding of UDP 53 alone is not seen).
• Guessed passwords. Tries are slowed down, a second factor is available, sessions end by themselves.

What it does not prevent#

• The first hour. Until the box is installed, anyone on your network who knows the default password (it is public: it is the month of the version) can install it in your place, during the hour after each start.
• An administrator who misuses the box. An administrator can send every name asked to a SIEM, give an adult's devices to a child, link their own account to an adult who has none and then see that person's history, or reset a password. All of it is written in the activity log, which the other administrators read, but the adult concerned is not always told.
• A phone with a new private Wi-Fi address is a new device: until you place it, it gets the rules of an adult, unless the Protections page protects unknown devices as a child or a teenager.
• An address of protection outside the home (chapter 11) that someone else got: whoever has it gets the rules of that device. Keep these addresses like passwords; New address cancels one at once.
• Allowed networks widened by hand. If someone sets WARDA_ALLOWED_CLIENTS with public addresses, Warda answers the Internet: it only writes a warning in its log at start.
• A modified program. Whoever changes the program of Warda on their own box can unlock anything there.

What you can do#

1. Install Warda as soon as it has started for the first time, from a computer of your own network. On a shared network (an office, a building), plug it into a network of its own until it is installed.
2. Never forward ports 53, 853 or 443 of your router to Warda, and never publish its interface on the Internet: for your devices away from home, use the protection outside the home (chapter 11).
3. Give the administrator role only to people you trust, and read the activity log from time to time.
4. Keep your backups and their password safe: a backup holds every account and the key of the box.