DNS server over UDP and TCP, answering only local network clients.
Encrypted upstream resolution: Quad9 then Cloudflare, DNS over TLS first,
DNS over HTTPS next, plain DNS as a last resort so that resolution never stops.
Base blocklist (advertising and tracking) of the lists of Warda
(warda-lists, see Lists), checked every hour and kept on
disk, so Warda starts without network access; from 0.7.11 the dashboard
tells its entries and the names of the source lists they cover.
Personal allow and block lists, which always win over the downloaded
lists: domains, or regular expressions written /pattern/ (see
Personal rules).
Blocking of trackers hidden behind a CNAME of the visited site.
Local names (.local, .lan, .home.arpa, private reverse lookups…) never
leave the network; conditional forwarding sends a local zone to your router.
Response cache, and one upstream request for identical concurrent queries.
Web interface in English, French, Spanish, German, Dutch, Italian and
Portuguese (the language of the browser first, then the one chosen in a
menu where each has its flag, drawn as on the site), at
http://warda (redirected to HTTPS; from 0.7.10 to the name of the box
once its certificate is one the browsers trust, see
From HTTP to HTTPS), named Warda-DNS and drawn with the
charter of the site (Améthyste, light and dark): menus that say what each
page is for, the state of the protection and the account in the header,
tabs at the bottom of a phone; dashboard with modules you add, remove and
move (protection, the network live, activity, health and services of the
box…), periods from real time to last month, devices, household (one card
per person), reports, suggestions, rules, administration log and
accounts. Confirmations are dialogs of the page (the password asked there
for what erases or cuts) and the messages after an action can undo it.
The tab of the browser is named after the page; numbers and units follow
the language chosen, and a change of language reloads the page (so that
the names Warda makes for the devices follow it). A page whose loading
fails says so instead of staying on "Loading…", and the live stream of
the dashboard stops when another page is opened.
Household: devices given to people (child, teenager, adult), detailed
reports for minors only, and for an adult whose account an administrator
linked to their person, who accepted the link and agreed; otherwise the other adults see how many queries
their devices make and what Warda blocked for them, never the names they
visit. What a device did is shown for a person only from the moment it was
given to them, and an adult is warned on their dashboard when one of their
devices is given to someone else. The machines of a group made by the
account of an adult who did not agree (see
Groups of devices) are kept private the same way. A person changed from adult to child or
teenager has the history of their devices start at the change: the past
of the adult is never shown. This protects adults from each other's
curiosity, not from an administrator who misuses the administration: every
change is written to the administration log. From 0.7.10 a device can be
given to several people who share it: it follows the most protective
rules among them and is counted for none of them (see
Devices shared by several people).
Two roles in every plan (see Roles): administrators do
everything (accounts, backups and their restore, the emergency account
included); members use Warda (dashboard, reports, "something is broken"
on a device and one-click unblocking, for that device only, of what was
blocked for it just before unless an administrator blocked it, their own
account, and with Warda Business the unblock requests) but change nothing
for the others. With Warda Business, groups of accounts give members roles
of a fixed catalogue (everyday management, read-only, backups…).
Categories (security threats, adult content, violence, hate and
terrorism, drugs, gambling, piracy, social networks, videos, games, job
sites, new domains) allowed, monitored or blocked per profile, with alerts
for the monitored ones in the reports of minors.
"Something is broken": filtering off for one device for 15 minutes, with
what was blocked for it in the last 5 minutes to unblock in one click, for
that device only (listed on the rules page); the
whole network can be paused the same way in an emergency, shown in red on
every page.
Statistics per minute (2 days), hour (35 days) and day (400 days), counted
as the journal is written; the real-time view shows the last 5 minutes in
steps of 10 seconds, sent to the browser every 2 seconds.
/healthz and /api/v1/stats endpoints on port 80: states and counts
only (see Data and security).
Encrypted query journal on the device, kept 30 days: it never leaves it.
Device discovery: hardware address, maker and network name of each device
that uses Warda; a scan of the network (at start, every night at 03:15 and
on demand) lists the other machines too, so that those not protected yet
show. One machine is one device: its names lose the domain of the local
network, and a machine seen twice (a new IPv6 address, the name given by
the router) is merged by itself, or by hand with Merge…. See
Network scan and One device per machine.
Installation assistant: one step at a time over the dashboard, then the
steps to point your box at Warda (Free, Orange, SFR and Bouygues Telecom
boxes are recognised on the local network).
DHCP server (off by default) for the boxes whose DNS server cannot be
changed, with reserved addresses and local names. See
DHCP server.
Month of birth of children: the profile follows the age (teenager at 15,
adult at 18), checked every hour.
Learning: Warda looks for trackers and telemetry in the journal and
suggests blocking them, with the device, what came just before and the
role of the domain in plain words. It never blocks anything by itself,
unless an administrator turns on, at the level High only, the automatic
blocking of the new trackers it is surest of (from 0.8.0, off by
default, each one listed and undone in one click: see
Automatic blocking of confident trackers).
From 0.8.0 (beta): the protection outside the home
(subscription: the enrolled phones and laptops keep the filter of the
house on mobile data and other Wi-Fi networks, through the online
service, and a minor's device that switches to mobile data at home is
told), the known data breaches (subscription:
the e-mail addresses of the household checked every week by
k-anonymity; free: a test of a password), the
exposure on the Internet (free: the ports
the router opens, a check from outside of the address of the home,
telnet and FTP on the network), the
restricted mode for connected objects
(free: an object keeps to the names it learned), the mining pools
blocked for everyone (free, see
Threats in the names and the answers)
and lists of hashes for the category of child sexual abuse material
(see Sensitive categories).
From 0.8.2 (beta): the reputation of the domains
(free: the opinion of the analysis service of Warda on the domains the
household does not know, domain names only; the malicious ones blocked
for everyone, the suspicious ones for the minors, and the suspicious
ones registered less than 14 days ago for everyone: on new
installations from 0.8.2, on the boxes installed before once Warda
reads the option again, unless an administrator turned it off), the
sign-in of the people of the
directory (Warda Business:
their password of Active Directory or LDAP, Microsoft Entra ID, Google
Workspace), and in a pair the secondary that
relays the devices protected outside the home while the primary is
down.
Collective base (subscription, beta; off until an administrator turns it
on): the opinion of the analysis service of Warda on the names the box
doubts, in exchange for the decisions of its administrators, domain names
only. See Collective base.
Warda Business (beta, open to every installation during the beta): data
loss prevention by the names asked (file transfers, personal storages,
paste sites, anonymous file hosts, personal webmails, AI assistants:
allowed, told or blocked), unblock requests of the accounts answered by
the administrators, a security center (a score out of 100 and the actions
to take by priority), the AI services (their use and their policy), the
policies by kind of device, the users of the directory (Active Directory,
LDAP, from 0.8.2 Microsoft Entra ID and Google Workspace, and their
sign-in to Warda), the reports of the company, the high availability of two boxes
(a shared address, VRRP) and the sites of an organisation relayed by the
online service. See Data loss prevention,
Unblock requests, Security center,
AI services, Device policies,
Users of the directory,
Company reports,
High availability and Sites.
Administration from the web interface, the command line and an HTTPS API
with a token; maintenance actions (resolver restarted, network table or
logs emptied) on the System page.
Proxy auto-configuration (WPAD), off by default, for a network that runs
its own proxy. See Proxy auto-configuration (WPAD).
Terms of use accepted at the installation, and anonymous daily statistics
(on by default, turned off in one click). See
Terms of use and anonymous statistics.
Encrypted backups of the configuration every night, copied to a USB drive,
restored in a few clicks (even at the installation of a new box); signed
automatic updates at night (Debian package), new versions announced on
the System page (Docker image and archive).