Privacy-first DNS filter for home and small business networks. Warda blocks advertising, tracking and telemetry for every device on the network, and keeps what it learns on your own hardware.
Status: before the open beta — the DNS engine, local learning, the web interface and the DHCP server.
User guide: step by step, with a short summary at the top of each
chapter, in English, français,
español, Deutsch,
Nederlands, italiano and
português. This page is the technical reference of the software; the code is in the
repository warda-dns/warda, at the same version tag as this documentation.
How Warda compares with Pi-hole and AdGuard Home, and what it does not do
yet: comparison.
The visual identity (colours, logos, fonts) is in brand: the
interface uses its package @warda-dns/brand and embeds its fonts (SIL Open
Font License), nothing is loaded from outside.
- What Warda doesDNS server over UDP and TCP, answering only local network clients. Encrypted upstream resolution:
- First sign-inA new Warda has one account, admin, with the default password Ward@-MM-YYYY, where MM-YYYY is the month and year of its version (the date of the commit the…
- RolesIn every plan, an account is an administrator or a member (internal/auth, role of the account: admin or member):
- LearningFor 7 days after installation, and 48 hours for each new device, Warda only observes: warda status already shows the devices, what was blocked for each one and…
- Collective baseProtection → Collective base (collective, a function of the subscription; beta: open to every installation; internal/collective) is off by default on every…
- Sensitive categoriesThe Protection settings page (Protection → Protection settings; up to 0.8.4 the page was called Protections, under the same menu) sets, for each profile…
- Data leaks through DNSA program on a device can hide data in the names it asks — a DNS tunnel (iodine, dnscat2, dns2tcp, malware) — to send a file out or take its orders, through…
- Look-alike namesA name can be made to be mistaken for another: a homograph imitates it with letters of other alphabets (аpple.com with a Cyrillic а, asked in the DNS as…
- Reputation of the domainsFrom 0.8.2 (free, beta, feature reputation; internal/reputation, internal/admin/reputation.go).
- Threats in the names and the answersProtection → Protection settings, card Threats in the names (administrators; free, beta, each check on by default; internal/threats). The rule of the card:
- Known data breachesFrom 0.8.0 (beta; internal/breach, internal/admin/breaches.go, internal/httpapi/breach.go). The threat it answers:
- Personal rulesProtection → My rules (GET /api/v1/rules, PUT|DELETE /api/v1/rules/{domain}, administrators; warda allow, warda block, warda unrule) always wins over the…
- Hours of InternetHousehold → Hours of Internet (administrators; a function of the subscription, open to every installation during the beta) sets, for each child and teenager…
- AlertsProtection → Alerts (administrators; subscription, open during the beta) lists over 30 days, new ones first marked:
- Summary of the weekReports → Summary of the week (reports.weekly, subscription, open during the beta; internal/admin/weekly.go) shows the week going on for each person whose…
- Time spentReports → Time spent (subscription, open during the beta) estimates, for a child, a teenager or an adult who agreed to reports, the time on Internet this week…
- Devices shared by several peopleFrom 0.7.10 (beta, free; internal/category/shared.go, internal/admin/shared.go). A device used by several people of the household (the tablet of the family…
- Raspberry Pi imageFor a Raspberry Pi 4 or later, the release page has a ready image, warda_<version>_raspberrypi-arm64.img.xz:
- Install on Debian, Ubuntu or Raspberry Pi OS (64-bit)Download the package of your architecture from the release page, then:
- Install on Fedora, RHEL, Rocky Linux or AlmaLinux (64-bit)Download the rpm package of your architecture from the release page, then:
- UpdatesWith the Debian or rpm package (and the Raspberry Pi image), Warda updates itself: once a night between 02:00 and 05:00 (each machine at its own time), it…
- Settings and systemEverything a household needs is in the web interface, for the administrators:
- DHCP serverFor the boxes that do not let you change the DNS server they give (Livebox in France, SFR Box, Speedport, Vodafone Station in Germany, Ziggo, Virgin Media, BT…
- Proxy auto-configuration (WPAD)Network → Local DNS → Network proxy (WPAD) (GET|PUT /api/v1/wpad, administrators), off by default.
- ReportsEvery page is named as its entry in the menu. The tile Online services of the dashboard shows the services of Warda on Internet as the box sees them:
- Query logReports → Query log (GET /api/v1/queries, every account since 0.6.8) lists the queries of the journal, newest first. Since 0.6.9 the page reads them from the…
- Local DNS recordsNetwork → Local DNS → Records of the local DNS (GET|POST /api/v1/dns-records, DELETE /api/v1/dns-records/{id}, administrators) holds names given by hand:
- Services and safe searchProtection → Services and safe search (GET|PUT /api/v1/blocked-services, PUT /api/v1/safe-search, administrators).
- Data loss preventionBusiness → Data loss prevention (business.dlp, Warda Business, beta: open to every installation during the beta; internal/category dlp.go, i…
- Unblock requestsAsk to unblock, in the account menu (the initial at the top right; business.unblock, Warda Business, beta:
- Security centerBusiness → Security center (business.center, Warda Business, beta: open to every installation during the beta; internal/admin/center.go) gathers what the other…
- AI servicesBusiness → AI services (business.ai, Warda Business, beta; internal/admin/ai.go): the AI assistants of the catalogue of services (ChatGPT, Claude, Copilot…
- Device policiesBusiness → Device policies (business.devices, Warda Business, beta; internal/admin/devicepolicy.go):
- Users of the directoryBusiness → Users of the directory (business.identity, Warda Business, beta; internal/directory, internal/admin/directory.go, go-ldap v3, MIT):
- Company reportsReports → Company reports (business.reports, Warda Business, beta; internal/admin/businessreport.go):
- Company logoFrom 0.8.5 (function business-logo of the catalogue, business.logo, Warda Business, open during the beta; internal/admin/logo.go).
- High availabilityBusiness → High availability (business.ha, Warda Business, beta; internal/ha, internal/admin/ha.go):
- SitesBusiness → Sites (business.sites, Warda Business, beta; internal/admin/orgsites.go): the boxes of distant sites (behind NAT, no port to open) gathered in an…
- Customer areaFrom 0.7.5. Administration → Customer area (administrators, area system; internal/admin/account.go, ui/src/pages/CustomerArea.svelte, route /customer-area…
- Failover of the domainsShould the project lose control of Cloudflare (registrar of warda-dns.com and warda-dns.net, DNS of every zone, tunnel), the owner can, from OVH alone…
- Encrypted DNS for the devicesNetwork → DNS services (GET /api/v1/dns-services, administrators) serves DNS over TLS (RFC 7858, port 853), over HTTPS (RFC 8484, path /dns-query on the HTTPS…
- Protection outside the homeFrom 0.8.0 (subscription, roaming; beta, open to everyone during the beta; internal/roaming, internal/admin/roaming.go, internal/relayaddr).
- From HTTP to HTTPSFrom 0.7.10 (beta; internal/admin/httpsredirect.go, NewRedirectHandler of internal/httpapi). The plain HTTP listener has never served the interface:
- DNSSECWarda asks the upstream servers with the AD bit (RFC 6840): a validating resolver says whether it checked the signatures, without sending them.
- AnswersNetwork → DNS services → Answers (PUT /api/v1/dns-services/policy {"blocked_response": "page"|"null"|"nxdomain"|"refused"|"default", "rate_limit":
- Block pageFrom 0.8.3 (beta, free; function block-page of the catalogue, and after 0.8.4 block-page-same-device; internal/blockpage). The request behind it:
- IPv6 announcementsA box that gives IPv6 announces its own DNS server in its router advertisements: the devices may use it and go around Warda.
- Network checkWhat lets devices go around Warda without anyone knowing, checked every 5 minutes (task network.checks, the first 2 minutes after start) and shown in Network →…
- Scheduled tasksAdministration → Scheduled tasks (GET /api/v1/tasks) lists what Warda runs by itself, each with its name and a sentence saying what it does (0.6.9 adds those…
- Groups of devicesA device is used by a person of the household (from 0.7.10, or by several who share it: see Devices shared by several people) or put in a group, never both.
- Kinds of devicesFrom 0.7.10 (store.Kinds, internal/classify/kind.go). The column Kind of Household → Devices says what a device is. Up to 0.7.9 it held two values, Device and…
- Restricted mode for connected objectsFrom 0.8.0 (free, every plan, homes and Warda Business; beta; catalogue restricted-mode; internal/restrict). The threat it answers:
- Network scanWarda looks at the network of its default gateway only (a /23 at most), and nothing leaves it:
- Network toolsNetwork → Tools (administrators; one at a time, 30 runs a minute at most, each run in the administration log):
- Exposure on the InternetFrom 0.8.0 (free, every plan, not gated; beta; catalogue internet-exposure; internal/exposure, internal/admin/exposure.go). The threat it answers:
- BackupsA backup holds the configuration: accounts (with their password hashes and second factors), household, hours of Internet, times a day, school holidays…
- Run with DockerOn a Raspberry Pi 4 or later with a 64-bit system, or on any amd64 or arm64 server with Docker and its Compose plugin, in an empty directory:
- ConfigurationEvery setting is a flag of warda serve or an environment variable.
- CommandsAdministration, on the machine that runs Warda (sudo warda … with the Debian package, docker exec warda warda … with Docker):
- Data and securityEverything Warda records stays in its data directory (/var/lib/warda):
- Misuse and how Warda prevents itWarda is a resolver, an interface and an online relay on the network of a home or a small company.
- Warda, Pi-hole and AdGuard HomeHow Warda compares with the two best-known self-hosted DNS filters, and what it does not do yet. Pi-hole (EUPL-1.2) and AdGuard Home (GPL-3.0) are free…
- Where to buy the hardwareWhat to buy to run Warda on a Raspberry Pi, and shops that sell it, by country. The user guide gives the same advice in each language, with the shops of its…