How Warda compares with the two best-known self-hosted DNS filters, and what it does not do yet. Pi-hole (EUPL-1.2) and AdGuard Home (GPL-3.0) are free software with their own licences: Warda (AGPL-3.0) takes ideas from what they show, never their code.
The comparison describes their public versions known in 2026; it will age, and each project keeps its own documentation up to date.
At a glance#
| Warda | Pi-hole | AdGuard Home | |
|---|---|---|---|
| Blocklists, own allow and block rules | yes | yes | yes |
| Learns on the box which names to suggest blocking | yes | no | no |
| People of the household, profiles by age, reports per child | yes | no | no |
| Sensitive categories (adult, gambling, violence…) by profile | yes | through lists | through lists and services |
| Hours of Internet, time a day, school holidays, requests of a child | yes | no | blocking schedule of services |
| Detection of the ways around the filter (VPN, proxy, encrypted DNS) | yes, with alerts | no | no |
| "Something is broken" on a device (pause and one-click unblock) | yes | no | no |
| Network scan, local names, groups of devices, managed switches | yes | local names | clients and local names |
| DHCP server | IPv4 and IPv6 | IPv4 and IPv6 | IPv4 and IPv6 |
| Encrypted upstream servers (DoH, DoT) | yes | through a companion | yes |
| Encrypted DNS for the devices (DoH, DoT, DoQ) | yes, with a free certificate renewed by itself | no | yes, certificate to bring |
| SafeSearch, blocking of named services | yes, by profile, group, person or device | no | yes |
| DNSSEC validation | yes, by Warda itself (option) or by the upstream servers | yes | yes |
| Custom local records (A, CNAME…) | yes | yes | yes |
| Query log with search, filters and live view | yes | yes | yes |
| Rule from a row of the query log | yes | yes | yes |
| Encrypted database | yes | no | no |
| Automatic updates | signed, with rollback | by hand (pihole -up) |
yes |
| Rules per device, rate limiting per client, choice of the answer to a blocked name | yes | yes | yes |
| Filtering outside the home (mobile data, other Wi-Fi) | yes, from 0.8.0 (subscription, beta): a DNS over HTTPS address per device at the online service of Warda, relayed to the box with the whole policy of the device; Android needs an app (Private DNS cannot take the address); unfiltered while the box is unreachable (from 0.8.2, in a pair of high availability, the secondary relays while the primary is down); the names of the home network answered at home only | no (through a VPN to the house) | yes, a DNS over HTTPS address per client, once the server is published on the Internet with a name and a certificate |
| Device on mobile data at home, connection probably shared from it | told to the parents, inferred (from 0.8.0, subscription, enrolled devices of minors) | no | no |
| Connected objects kept to the names they learned | yes, from 0.8.0 (free): restricted mode by device or group, learning then block, one-click allow | by hand (group rules) | by hand (rules per client) |
| Services of the house exposed on the Internet | yes, from 0.8.0 (free): the UPnP mappings of the router, a check from outside of the public address (TCP, fixed list of risky ports; not UDP, not the IPv6 pinholes of the devices), telnet and FTP on the network | no | no |
| Addresses of the household in known data breaches | yes, from 0.8.0 (subscription, k-anonymity through the online service; not open until its Have I Been Pwned key is set), and a test of a password (free) | no | no |
| Mining pools | blocked for everyone by default, the device told (from 0.8.0, free) | through lists | through lists |
| Phishing sites on no list yet | the opinion of the analysis service of Warda on the domains the household does not know (from 0.8.2, free, beta; the domain alone leaves the box): malicious blocked for everyone, suspicious for the minors, suspicious and registered less than 14 days ago for everyone on new installations | lists only | lists only |
| Sign-in with the company directory | from 0.8.2 (Warda Business, beta): the password of Active Directory or LDAP, Microsoft Entra ID, Google Workspace, the rights given by the groups of the directory | no | no |
| Trackers blocked without a person | optional, at the learning level High only: the new trackers the learning is surest of, listed and undone in one click (from 0.8.0) | lists only | lists only |
| Child sexual abuse material | a category always blocked, which accepts a confidential list of hashes of an authorised body; no such list is loaded yet | through lists | through lists |
What Warda does differently#
- A household, not a list of IP addresses. Devices belong to people or groups; the protections follow the age of each person, and adults are never watched (their detailed reports need their own agreement).
- Local learning. Warda studies its own journal and suggests names to block, with the reason, instead of relying only on lists.
- For parents. Hours of Internet, time a day per category, school holidays from the official calendars, requests for more time, alerts when a child tries to go around the filter, weekly summary (kept 52 weeks, and sent by e-mail through your own mail server).
- Beyond the names of the house (0.8.0, beta). The phones of the family keep their filter outside (their queries transit Cloudflare and the online service of Warda, which keeps none of them), the box tells what the router exposes on the Internet and which addresses of the household are in known breaches, and connected objects can be held to the names they learned.
- Built to be left alone. Encrypted nightly backups (and a copy to a USB drive), signed automatic updates with rollback, a page of the scheduled tasks, a diagnostic without browsing data.
What Warda does not do yet#
The high availability of two boxes and the export to a SIEM, once listed here, are in Warda Business since 0.6.8 (beta, open to every installation during the beta). The strict mode for the connected objects, once listed here too, is in Warda 0.8.0 for every plan: the restricted mode for connected objects (beta). The sign-in with the directory (the password of Active Directory or LDAP, Entra ID and Google Workspace), once listed here too, is in Warda Business 0.8.2 (beta). Still to come, in the order they are planned (none is promised for a given version):
- Actions on the sites of an organisation (Warda Business): give the rules and policies of the company to every site, update every site at once, gather the reports of every site. 0.6.8 shows their state only.
- HTTPS inspection: only for the devices chosen, never without the knowledge of the people concerned.
- A list against child sexual abuse material: Warda 0.8.0 can apply the hashed list of an authorised body (the Internet Watch Foundation, or the body of the country), but none is obtained yet.
Ideas taken from their interfaces#
The charts and the query log of Warda follow ideas both projects made familiar, drawn again in the charter of Warda:
- an activity chart by steps of 10 minutes over 24 hours, whose window shows under the chart and opens the queries of that window;
- small curves under the figures of the dashboard, rings for the types of queries, the reasons of blocking and the upstream servers, tops with the share of each name;
- a query log with one search box, a filter of the result and of the device, a live view, tinted rows and a rule in one click.
See the technical reference for what each part of Warda does.