Privacy-first DNS filter for home and small business networks. Warda blocks advertising, tracking and telemetry for every device on the network, and keeps what it learns on your own hardware.
Status: before the open beta — the DNS engine, local learning, the web interface and the DHCP server.
User guide: step by step, with a short summary at the top of each
chapter, in English, français,
español, Deutsch,
Nederlands, italiano and
português. This page is the technical reference of the software; the code is in the
repository warda-dns/warda, at the same version tag as this documentation.
How Warda compares with Pi-hole and AdGuard Home, and what it does not do
yet: comparison.
The visual identity (colours, logos, fonts) is in brand: the
interface uses its package @warda-dns/brand and embeds its fonts (SIL Open
Font License), nothing is loaded from outside.
- What Warda doesDNS server over UDP and TCP, answering only local network clients. Encrypted upstream resolution:
- First sign-inA new Warda has one account, admin, with the default password Ward@-MM-YYYY, where MM-YYYY is the month and year of its version (the date of the commit the…
- LearningFor 7 days after installation, and 48 hours for each new device, Warda only observes: warda status already shows the devices, what was blocked for each one and…
- Sensitive categoriesThe Protections page sets, for each profile (child, teenager, adult and devices given to nobody), what Warda does with each category:
- Personal rulesProtection → My rules (GET /api/v1/rules, PUT|DELETE /api/v1/rules/{domain}, administrators; warda allow, warda block, warda unrule) always wins over the…
- Hours of InternetHousehold → Hours of Internet (administrators; a function of the subscription, open to every installation during the beta) sets, for each child and teenager…
- AlertsProtection → Alerts (administrators; subscription, open during the beta) lists over 30 days, new ones first marked:
- Summary of the weekReports → Summary of the week (subscription, open during the beta) shows for each child: the time on Internet against last week, the three sites most used, the…
- Time spentReports → Time spent (subscription, open during the beta) estimates, for a child, a teenager or an adult who agreed to reports, the time on Internet this week…
- Raspberry Pi imageFor a Raspberry Pi 4 or later, the release page has a ready image, warda_<version>_raspberrypi-arm64.img.xz:
- Install on Debian, Ubuntu or Raspberry Pi OS (64-bit)Download the package of your architecture from the release page, then:
- UpdatesWith the Debian package (and the Raspberry Pi image), Warda updates itself: once a night between 02:00 and 05:00 (each machine at its own time), it installs…
- Settings and systemEverything a household needs is in the web interface, for the administrators:
- DHCP serverFor the boxes that do not let you change the DNS server they give (Livebox, SFR Box), Warda can give the addresses of the network itself:
- Proxy auto-configuration (WPAD)Network → Local DNS → Network proxy (WPAD) (GET|PUT /api/v1/wpad, administrators), off by default.
- ReportsEvery page is named as its entry in the menu. The tile Online services of the dashboard shows the services of Warda on Internet as the box sees them:
- Query logReports → Query log (administrators; GET /api/v1/queries) lists the queries of the journal, newest first, 100 at a time:
- Local DNS recordsNetwork → Local DNS → Records of the local DNS (GET|POST /api/v1/dns-records, DELETE /api/v1/dns-records/{id}, administrators) holds names given by hand:
- Services and safe searchProtection → Services and safe search (GET|PUT /api/v1/blocked-services, PUT /api/v1/safe-search, administrators).
- Encrypted DNS for the devicesNetwork → DNS services (GET /api/v1/dns-services, administrators) serves DNS over TLS (RFC 7858, port 853), over HTTPS (RFC 8484, path /dns-query on the HTTPS…
- DNSSECWarda asks the upstream servers with the AD bit (RFC 6840): a validating resolver says whether it checked the signatures, without sending them.
- IPv6 announcementsA box that gives IPv6 announces its own DNS server in its router advertisements: the devices may use it and go around Warda.
- Scheduled tasksAdministration → Scheduled tasks (GET /api/v1/tasks) lists what Warda runs by itself, with the last run (time, duration, error), the next one and whether it is…
- Groups of devicesA device is used by a person of the household or put in a group, never both. Seven default groups cannot be deleted:
- Network scanWarda looks at the network of its default gateway only (a /23 at most), and nothing leaves it:
- Network toolsNetwork → Tools (administrators; one at a time, 30 runs a minute at most, each run in the administration log):
- BackupsA backup holds the configuration: accounts (with their password hashes and second factors), household, hours of Internet, times a day, school holidays…
- Run with DockerReplace 192.168.1.2 with the local network address of the host. Publish the ports on that address only:
- ConfigurationEvery setting is a flag of warda serve or an environment variable.
- CommandsAdministration, on the machine that runs Warda (sudo warda … with the Debian package, docker exec warda warda … with Docker):
- Data and securityEverything Warda records stays in its data directory (/var/lib/warda):
- Warda, Pi-hole and AdGuard HomeHow Warda compares with the two best-known self-hosted DNS filters, and what it does not do yet. Pi-hole (EUPL-1.2) and AdGuard Home (GPL-3.0) are free…