Warda is a resolver, an interface and an online relay on the network of a home or a small company. This section lists how someone with bad intentions could try to divert it, what Warda does against each, and what it does not do. "Administrator" means an account with the right concerned (see Roles); "member" an account of everyday use (always an adult: only an adult person can be linked to an account).
The box as a weapon against others#
| Threat | What Warda does | Limits |
|---|---|---|
| Open resolver reachable from the Internet (reflection, amplification) | DNS (UDP, TCP), DoT, DoQ, DoH, the interface and the API answer only the allowed ranges: the private ranges, loopback, link-local and, with the default list, the global IPv6 networks and the CGNAT networks the machine itself is connected to (read again every minute). Other sources are dropped without an answer (UDP) or refused (403). A port forwarding of the router keeps the address of the client: still refused. Answers over UDP are at most 1,232 bytes (truncated beyond, the client retries over TCP); zone transfers are refused. | WARDA_ALLOWED_CLIENTS set by hand replaces the list as is: 0.0.0.0/0 makes an open resolver, and there is no rate limit by default (rate_limit 0). From 0.8.0 Warda warns once at start when it holds ranges beyond the local networks (0.0.0.0/0, ::/0, a public IPv4 range, a global IPv6 range wider than a /48): "allowed clients include ranges beyond the local networks: any address of the Internet among them can use Warda as an open resolver … keep WARDA_ALLOWED_CLIENTS to the local networks", with the ranges; it still answers them. Never put a public range in it. A router that rewrites the source of forwarded connections (some do in "DMZ"/proxy modes) makes every client look like the router: never forward port 53, 853 or 443 to Warda. On a hosting provider whose interface carries a /64 shared with other customers, they are allowed too. |
| Reverse proxy or tunnel in front of the interface (Traefik, Caddy, nginx, cloudflared on the same machine or network) | From 0.8.0, a request that says it is forwarded for an address (X-Forwarded-For, X-Real-IP, CF-Connecting-IP, True-Client-IP, Forwarded: for=) is refused with 403 "Warda is not served to the Internet through a reverse proxy or a tunnel" when one of those addresses is not allowed, or when it names more than 32. This covers the interface, the sign-in, the installation and DNS over HTTPS. |
A proxy that sends no such header (a plain TCP forward, an nginx without proxy_set_header X-Forwarded-For) is not seen. Warda is never meant to be published on the Internet: use the protection outside the home for devices away. Moving the ports 80 and 443 beside a reverse proxy (Run with Docker) shares the machine, it does not publish Warda. |
| Scanner or flooder: the network tools (ping, traceroute, DNS test, TCP port test, Wake-on-LAN, "who uses this address"), the test of a SIEM collector, the test of a directory | Administrators of the network only (tools), of the system (SIEM) or of the accounts (directory). One at a time and 30 a minute in all: from 0.8.0 the tests of the SIEM and of the directory are counted with the tools (409 "too many runs, wait a minute"). A ping is 4 packets, a traceroute 30 hops, a port test one TCP connection; the scan of the network covers only the networks of the box; "who uses this address" only the local IPv4 network. Every run is in the administration log. | An administrator can still point the custom resolvers, the local zones or the SIEM export at any address: they receive the household's own traffic, at its own rate. |
| Request forgery (SSRF) towards the services of the network or of the cloud (169.254.169.254, the page of the router) | The list sources, the update sources, the online service and the ACME directory are set in the configuration only (root), never from the interface. The reading of UPnP asks only a machine of the networks of the box, at the address that answered, in plain HTTP, never following a redirection, with sizes and times bounded. Updates are checked against the Ed25519 signature of SHA256SUMS and never go back to an older version; the failover records are signed too. The saved password of a directory is sent only to the address, account, authority and StartTLS mode it was typed for: from 0.8.0 a changed authority or StartTLS mode asks for the password again, so an administrator cannot send the saved password to a server of their own by changing only those. |
The SIEM test and the directory test say whether a connection worked: an administrator learns whether a port answers (counted with the tools, as above). |
One member of the household against another#
| Threat | What Warda does | Limits |
|---|---|---|
| Raise one's rights through the API | Each route declares its permission in one table (routePermissions), checked at start and by a test over every route; a member has only the everyday use (dashboard, "something is broken", one-click unblock of what was blocked for a paused device, own account). Nobody gives rights they do not have, nor changes an account with more rights. |
— |
| Go around the controls of a minor | Accounts are for adults only (a linked person cannot become a minor). The categories, the hours of Internet and the quarantine are decided before the pauses: "something is broken" never opens adult content nor the hours of a child, and its one-click unblock refuses a name an administrator blocked or a category of the profile. VPN, proxies and encrypted DNS are blocked for minors and reported (bypass.tool); a device asking during a cut, gone or silent, IPv6 or DHCPv6 servers that go around Warda, mobile data at home and probable connection sharing are reported. |
A new hardware address (the "private Wi-Fi address" of a phone, turned on again or rotated) is a new device, placed nowhere: protected as nobody (adult rules) unless the Protections page protects unknown devices as a child or a teenager. Reported only as a new device. A minor who gets the address of protection outside the home of an adult's device (visible in the settings of a browser or a profile) is answered with the adult's rules: keep these addresses like passwords; New address revokes one at once. |
| Read the browsing of another adult | The names visited by an adult who did not agree to detailed reports are never shown to other accounts (reports, top names, query log, alerts and notices keep no name); a member sees only their own devices in the query log. | See Watching an adult for the administrators. |
| The 0.8.0 features | The addresses watched for breaches: added, removed and listed by the household's administrators; an account sees only those of its own person. Out-of-home enrolment and the restricted mode of objects: the right to change the devices only. The password test sends 5 hexadecimal characters of the hash, counted by session. | An administrator may watch any address, of anyone: the provider returns only non-sensitive breaches (as its public site does). |
Watching an adult (stalkerware)#
What is guaranteed in code: the names an adult visits are not shown to the other accounts unless that adult, signed in, agreed; the agreement is theirs alone; a linked person cannot be turned into a minor; an adult is told on their dashboard when one of their devices is given to someone else; the history of a device starts for its new person at the change; the bypass events of 0.8.0 never concern an adult's own device.
What is not prevented: an administrator has the box. They can enable the export to a SIEM with every name asked (it carries the names of every device, the private ones included), give an adult's devices to a minor (the adult is told only if their account is linked), link their own account to an adult person who has none (then see that person's devices as their own, history included), or reset an adult's password (the adult then cannot sign in with theirs). Each of these is in the administration log, which the other administrators read; none is shown to the adult who has no account. Warda protects adults from each other's curiosity, not from an administrator who misuses the administration.
Taking the box over#
| Threat | What Warda does | Limits |
|---|---|---|
| The installation | Until the first account exists, only the emergency account with the default password of the version (Ward@-MM-YYYY, public) opens an installation session, for 60 minutes after each start, from the allowed ranges only (the network), over HTTPS; its session lasts 30 minutes; guesses are limited like any sign-in. The new passwords may not contain the default one. |
Anyone on the network who knows the version can install the box first during that hour, and become its administrator. Install it as soon as it has started for the first time, from a computer of a network you trust (your own home network); on a shared network (an office, a building, a student residence), plug it into a network of its own (a separate router or VLAN) until it is installed. A box left uninstalled opens that hour again at each start: unplug it when you cannot install it now. |
| The interface from another site (CSRF, DNS rebinding) | HTTPS only; session cookie __Host-, Secure, HttpOnly, SameSite=Strict; a CSRF token and the same origin on every change; JSON bodies only; no framing; the pages open without sign-in (health, statistics, the page of a child, the proxy configuration) answer only to the names and addresses of the box. A rebinding site cannot get past TLS (the certificate is not for its name). |
— |
| Passwords and sessions | Argon2id; guesses counted per name and address and per IPv6 /64 (locks from 1 minute, doubling), a name slowed after 30 failures from anywhere but never locked for its owner; TOTP second factor with recovery codes; sessions end after 2 hours idle and 12 hours in all; a changed or reset password signs the other sessions out; the API token's failures are limited per address. | — |
| A backup | Encrypted and authenticated (XChaCha20-Poly1305, key from the password with bounded Argon2 costs), at most 32 MiB once decompressed, a JSON document (no archive, no path): only the four files of tls/ it may hold are written. Restoring needs the restore right. From 0.8.0 a backup restored on another box does not bring the plan of the customer area with it (see Backups). |
A backup carries every account and the key of the box: keep it and its password safe. |
| Updates | Signed SHA256SUMS (Ed25519, key in the program), checksum of the package, never an older version. |
— |
| The sign-in of the directory (from 0.8.2, Warda Business) | Who becomes administrator is decided by the Rights of the groups, saved only by an account that has every right of the groups mapped, before and after (403), with its password asked again. A name of an account of Warda never goes to the directory (the emergency account always signs in with its own password), and the time of the answer does not tell which names are accounts of Warda. Microsoft and Google: PKCE, a single-use state bound to the browser, the nonce, RS256 only, the exact tenant (no guests) or the Google domain with a verified address, fixed addresses of the providers and a fixed return (no open redirection); the unverified email claim of Entra is never used. 10 sign-ins under way per address or /64, 512 in all. |
Whoever manages the directory, Entra ID or Google Workspace decides who is in the groups mapped, and so who administers Warda. An administrator of Entra who can rename UPNs can take a person of AD not synchronised to Entra (hybrid match): import the people of Entra. An account that signs in only with Microsoft or Google cannot confirm the changes of the accounts (no password). Not tried yet against the real services. |
The online relay seen from someone who got an address#
An address of protection outside the home is 130 random bits; the box keeps only its hash. Whoever has it gets the DNS of that device, with its rules: the queries are journaled and counted as the device's. Bounds: the online service answers at most 50 queries a second per box and 20 per client address (429 beyond), the box at most 256 at once; the device is one bucket of the rate limit of the box when one is set. New address revokes it at once (the service then answers 404).
From 0.8.2 whoever has the address gets no name of the home network from outside: the names of Warda, the local records, the names of the devices and their reverse lookups, and the local zones answer NXDOMAIN (see Protection outside the home; at home they are on the network anyway). Limits: their queries fill the query log and the statistics of that device (and may make it reported, or put in quarantine); the household is not told that an address is used from several places.
What the checks of Warda see, and what they do not#
- A DNS port opened on the router. From 0.8.0 the exposure on the
Internet tries 53 (DNS) and 853 (DNS over
TLS) too, rated critical, with the advice to remove the forwarding:
a DNS server that answers the Internet is an open resolver. Before
0.8.0, a forwarding of the DNS ports made by hand was not reported. The
check from outside needs the terms of use in force accepted (from
0.8.2, those of
2026-10-13), and sees only the IPv4 address of the box (and over IPv6 the box itself). It is TCP only: a forwarding of UDP 53 alone is not seen. - Allowed ranges set by hand: a warning at start only (above); Warda still answers those ranges.
- The licence of the customer area stops a backup, a restore or a copy of the disk from running one Subscription on two boxes with Warda as shipped; a modified binary can unlock anything on its own machine (see Customer area).