DNS server over UDP and TCP, answering only local network clients.
Encrypted upstream resolution: Quad9 then Cloudflare, DNS over TLS first,
DNS over HTTPS next, plain DNS as a last resort so that resolution never stops.
Base blocklist (advertising and tracking) of the lists of Warda
(warda-lists, see Lists), downloaded every hour and kept on
disk, so Warda starts without network access.
Personal allow and block lists, which always win over the downloaded
lists: domains, or regular expressions written /pattern/ (see
Personal rules).
Blocking of trackers hidden behind a CNAME of the visited site.
Local names (.local, .lan, .home.arpa, private reverse lookups…) never
leave the network; conditional forwarding sends a local zone to your router.
Response cache, and one upstream request for identical concurrent queries.
Web interface in English, French, Spanish, German, Dutch, Italian and
Portuguese (the language of the browser first, then the one chosen), at
http://warda (redirected to HTTPS), named Warda-DNS and drawn with the
charter of the site (Améthyste, light and dark): menus that say what each
page is for, the state of the protection and the account in the header,
tabs at the bottom of a phone; dashboard with modules you add, remove and
move (protection, the network live, activity, health and services of the
box…), periods from real time to last month, devices, household (one card
per person), reports, suggestions, rules, administration log and
accounts. Confirmations are dialogs of the page (the password asked there
for what erases or cuts) and the messages after an action can undo it.
Household: devices given to people (child, teenager, adult), detailed
reports for minors only, and for an adult whose account an administrator
linked to their person, who accepted the link and agreed; otherwise the other adults see how many queries
their devices make and what Warda blocked for them, never the names they
visit. What a device did is shown for a person only from the moment it was
given to them, and an adult is warned on their dashboard when one of their
devices is given to someone else. The machines of a group made by the
account of an adult who did not agree (see
Groups of devices) are kept private the same way. A person changed from adult to child or
teenager has the history of their devices start at the change: the past
of the adult is never shown. This protects adults from each other's
curiosity, not from an administrator who misuses the administration: every
change is written to the administration log.
Two roles: administrators do everything; members use Warda (dashboard,
reports, "something is broken" on a device and one-click unblocking, for
that device only, of what was blocked for it just before unless an
administrator blocked it, their own account) but change nothing for the
others.
Categories (security threats, adult content, violence, hate and
terrorism, drugs, gambling, piracy, social networks, videos, games, job
sites, new domains) allowed, monitored or blocked per profile, with alerts
for the monitored ones in the reports of minors.
"Something is broken": filtering off for one device for 15 minutes, with
what was blocked for it in the last 5 minutes to unblock in one click, for
that device only (listed on the rules page); the
whole network can be paused the same way in an emergency, shown in red on
every page.
Statistics per minute (2 days), hour (35 days) and day (400 days), counted
as the journal is written; the real-time view shows the last 5 minutes in
steps of 10 seconds, sent to the browser every 2 seconds.
/healthz and /api/v1/stats endpoints on port 80: states and counts
only (see Data and security).
Encrypted query journal on the device, kept 30 days: it never leaves it.
Device discovery: hardware address, maker and network name of each device
that uses Warda; a scan of the network (at start, every night at 03:15 and
on demand) lists the other machines too, so that those not protected yet
show. See Network scan.
Installation assistant: one step at a time over the dashboard, then the
steps to point your box at Warda (Free, Orange, SFR and Bouygues Telecom
boxes are recognised on the local network).
DHCP server (off by default) for the boxes whose DNS server cannot be
changed, with reserved addresses and local names. See
DHCP server.
Month of birth of children: the profile follows the age (teenager at 15,
adult at 18), checked every hour.
Learning: Warda looks for trackers and telemetry in the journal and
suggests blocking them, with the device, what came just before and the
role of the domain in plain words. It never blocks anything by itself.
Administration from the web interface, the command line and an HTTPS API
with a token; maintenance actions (resolver restarted, network table or
logs emptied) on the System page.
Proxy auto-configuration (WPAD), off by default, for a network that runs
its own proxy. See Proxy auto-configuration (WPAD).
Terms of use accepted at the installation, and anonymous daily statistics
(on by default, turned off in one click). See
Terms of use and anonymous statistics.
Encrypted backups of the configuration every night, copied to a USB drive,
restored in a few clicks (even at the installation of a new box); signed
automatic updates at night (Debian package), new versions announced on
the System page (Docker image and archive).