11. Protection outside the home

A phone or a laptop that leaves the house leaves Warda. With the protection outside the home (from Warda 0.8.0), each device you enrol gets its own encrypted DNS address (DNS over HTTPS) at the online service of Warda. Wherever it is — mobile data, a friend's Wi-Fi, a hotel — its queries come back to your box and get the answers it gets at home: its rules, the profile of its person, the hours of Internet and the cuts, the pauses, the quarantine, the threats. In Reports → Query log, its queries carry the badge outside, and their detail gives the Path: Outside the home, through the online service (or At home, through the online service).

Turn it on and enrol a device#

1. The box needs a name of the online service of Warda: in Network → DNS services, step 1, choose the certificate A name given by Warda (chapter 9). Until then the page says Waiting: the box has no name of the online service of Warda, with Open the DNS services.
2. Open Household → Outside the home and tick Protect the enrolled devices outside the home. Connection to the online service then says Connected since ….
3. Optional: type the Name of the home Wi-Fi. The profiles of the iPhone, iPad and Mac then ask the box directly on that Wi-Fi, and the online service elsewhere. Left empty, they always go through the online service, which works at home too.
4. Under Device to enrol, choose the device (or click Protect outside on its row in Devices), then Give an address.
5. The address shows once, with Copy and a QR code: Warda keeps only a fingerprint of it. Keep it private (whoever has it gets the answers of this device) and set it up on the device right away (below; the page opens the instructions of the system it guesses). Lost: New address.

The enrolled devices are listed under Devices protected outside, 256 at most.

iPhone, iPad and Mac#

1. Right after giving the address, click Download the profile (iPhone, iPad, Mac). It can only be made at that moment: the box does not keep the address.
2. Send the profile to the device (AirDrop, e-mail) and open it.
3. iPhone and iPad: Settings → General → VPN & Device Management → the profile Warda – name of the device → Install. The device says the profile is not signed: that is expected.
4. Then, in Settings → General → VPN & Device Management → DNS, check that this profile is the one chosen (when another DNS profile is installed, such as the one of chapter 9, choose this one).
5. Mac: open the profile, then System Settings → Privacy & Security → Profiles, and install it.

A new profile for the same device replaces the old one.

Android#

The Private DNS setting of Android takes a server name, not an address: it cannot carry this one. Install an application that accepts a custom DNS over HTTPS address, and paste the address in it:

• RethinkDNS: DNS → Other DNS → DNS over HTTPS → custom URL;
• Intra: Settings → Select DNS-over-HTTPS server → Custom server URL.

Both work as a VPN on the phone itself: accept it, then in the VPN settings of Android turn on Always-on VPN for the application, so that it stays on. Set Private DNS back to Automatic. A phone runs one VPN at a time: another VPN would replace this one.

Windows 11#

1. Find an IPv4 address of the online service: in a terminal, type nslookup followed by the name of the service, the part of the address between https:// and /dns/.
2. Settings → Network & internet → Wi-Fi (or Ethernet) → Hardware properties → DNS server assignment → Edit → Manual.
3. Turn IPv4 on; Preferred DNS: that IPv4 address; DNS over HTTPS: On (manual template); template: the address of the device; fallback to plaintext: off. Save.

Do it for each connection the laptop uses (Wi-Fi, Ethernet). The address of the service can change: if the laptop no longer gets any name outside, look it up again and put the new one.

Firefox, Chrome and Edge#

• Firefox: Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom: paste the address.
• Chrome: Settings → Privacy and security → Security → Use secure DNS → Customised: paste the address.
• Edge: Settings → Privacy, search and services → Use secure DNS → Choose a service provider: paste the address.

Only what the browser asks is filtered: the other applications of the computer are not.

When the box cannot be reached#

When the box is switched off, the Internet of the house is cut or Warda restarts, the online service answers the devices itself through Quad9, which blocks known malware, so that they keep the Internet. These answers do not follow your rules. The page counts them under Answered without filter ("12 queries answered without filter while the box was unreachable (since …)"); Reset the count sets it back to zero. Under Answered by the box, the queries your box answered itself.

The enrolments are not in the backups: after a restore, give the devices new addresses. Changing the certificate of DNS services to another kind releases the name of the box: the addresses then stop working.

With two boxes in a pair (Warda Business, from Warda 0.8.2), the secondary answers in place of the primary while the primary is down, with your rules (see “Warda Business: high availability”, chapter 5).

Privacy and limits#

The queries of a device outside travel encrypted (HTTPS) from the device to Cloudflare, which carries the online service of Warda and sees them in passing, then to the online service and to your box, and back. The online service keeps none of them: no name, no answer, no address; only a fingerprint of each device address, the last connection of your box and counts by day. Your box records them in its journal and its statistics, like any other query of the device.

What it does not do:

• an application with its own DNS, a VPN or iCloud Private Relay goes around it; a browser set up alone filters only itself;
• on Android it depends on an application that can be stopped, and on an iPhone the profile can be removed in Settings (unless the device is supervised): Warda does not notice it, it simply receives no more queries;
• outside the home, the names of your network (warda, the devices, the local records) are not answered: they work at home only (from Warda 0.8.2).

Removing a device#

Under Devices protected outside, Remove stops the address at once: outside the home, the device then gets no answer at all until its setting is removed. Remove it: the profile (Settings → General → VPN & Device Management → the profile → Remove Profile), the address in the application, or the DNS over HTTPS of Windows or of the browser. New address replaces an address lost or given away: the old one stops at once; put the new one on the device.

Turning the protection off does not cut the enrolled devices: the online service then answers them without filter, as when the box is unreachable. To stop a device for good, Remove it.