A DNS ad blocker, and everything else Warda does

Blocking

• A built-in list, rebuilt every night (your box looks for a new one every hour), that blocks advertising, trackers, malware and phishing from the installation.
• Protection lists that grow faster: the Warda team gives its analysis service many addresses at once; each one is checked with several sources (VirusTotal, urlscan.io, threat feeds) and sorted by itself into the protection lists (phishing, malware, scams, advertising…) that every box downloads. Very popular sites are never sorted by themselves — a person reviews them — and a site blocked by mistake goes on a whitelist quickly. For this, only the addresses the team submits are sent to these services, never data of your household.
• Protections by category: adult content, gambling, social networks, recent domains, and more.
• Named services (video platforms, games, social networks) blocked for the whole network, a group, a person or a single device.
• Safe search forced on the main search engines and on YouTube.
• Your own list always comes first: one click to unblock a site.
• “Blocked by Warda” page (on by default, recommended; the administrator can choose another answer): instead of a page that does not load, the person sees that Warda blocked the site and why (its category or its list), with a link to ask for it to be unblocked. On secure (HTTPS) sites the page shows without a browser warning once the household’s own Warda certificate is installed on the device: a page of the box (/certificate) gives it, with step-by-step instructions for Windows, Mac, iPhone and iPad, Android, Linux and Firefox. This certificate authority is made by your box and stays on it: it never leaves the box and is never in the backups. Some apps ignore the certificates installed on the device and keep showing their own error, and the page needs the web interface of the box on ports 80 and 443 (with Docker, the ports must not have been moved elsewhere): otherwise the box keeps blocking silently, as before, and its settings say why. Only the page you open shows it: the blocked ads and trackers of a page stay invisible. With Warda Business, an administrator can also let the person unblock the site for 15 minutes on their own device after choosing why (off by default, a few times a day, never for a threat), and the page shows the logo of the company.
• Rules for a person or a group (beta, free): block or allow a site for one person on all their devices, shared ones included, or for a whole group of devices (the cameras, the guests…), for good or for an hour, a day, a week. A device rule wins over a person rule, which wins over a group rule; on a shared tablet, a block of one person blocks and an allow needs all of them. The query log and the block page say whose rule decided.

What Warda's counter counts, and how new lists are checked

← Previous: Small businesses Next: Security →

Security

• Malware, phishing and scams blocked for every device, even those you cannot install anything on: TV, console, connected objects.
• Reputation of the domains (beta, free): a domain your household does not know well is checked with Warda's analysis service, which gives its opinion. A malicious domain is blocked for everyone, a suspicious one for the children and teenagers, and a suspicious domain less than 14 days old for everyone (on by default on new installations). A name that imitates a known one is checked at its first query; any other is checked in the background, so the very first visit to a never-seen domain may pass, and if it is judged dangerous the block follows within minutes. Only the registrable domain leaves the box (example.com), never the device, the person or the time.
• Look-alike names: a name that imitates a bank or a known service with letters of another alphabet (аpple.com) never opens; a typing mistake (paypa1.com), a brand added to another name (paypal-login.help) or hidden in a subdomain (paypal.com.check-account.net) is reported, and blocked when the domain is only a few days old.
• A report of the misleading names: one line per name, with the name it imitates, its kind, what Warda did (blocked or reported), the number of queries and devices, first and last seen.
• Data leaks through DNS stopped: a program that hides data in the names it asks is spotted, its domain blocked for that device, and you are told.
• Attacks through the browser (DNS rebinding) stopped: an Internet name that answers with an address of your home (the box, a camera, the NAS) is blocked.
• Spyware (stalkerware) detected: the servers these apps report to are blocked, and the person whose phone is watched is told, not only the administrators.
• Remote control tools (AnyDesk, TeamViewer…), used in the fake support scams, and a device that calls the same rare server like clockwork are reported.
• The security report explains what is normal and what is not, with a button for each point (see the devices, the alerts, the protections, the quarantine); a device that behaves as an infected one is pointed out.
• A device that looks infected goes into quarantine in one click: through Warda, it reaches only its updates and its antivirus until you release it (a quarantine by the names: to cut it off entirely, unplug it).
• Exposure on the Internet (beta, free): once a week or on request, the online service of Warda tries from outside the risky ports of your own public address only (remote desktop, file sharing, cameras, databases…), Warda reads the ports your router opened by itself (UPnP) and looks for Telnet and FTP on your network. Each finding comes with its severity and plain advice, and a new one is reported. UDP services and the IPv6 openings of each device are not checked. A finding not found again for 7 days moves to a history, so that you see what is open now, and the dashboard has a card of its own.
• Known data breaches (subscription, beta): the e-mail addresses of the household are checked every week against known breaches with k-anonymity — only the first 6 characters of a fingerprint of each address leave the box, never the address — and each new breach is reported with what to do. The checks start when the breach service of Warda opens; until then the addresses are kept.
• Test a password (beta, free): your browser computes its fingerprint and sends only its first 5 characters; Warda tells you whether the password appears in known leaks. The password never leaves the browser.
• Hidden cryptocurrency mining blocked for everyone (beta, free): the mining pools and the miners that run in a web page do not answer, and a device that tries is reported, with quarantine one click away.
• Restricted mode for connected objects (beta, free, at home and in businesses): for a few days Warda learns the names a camera, a TV or a sensor needs, then allows only those; any other name is blocked and reported, and allowed again in one click. A program with its own resolver goes around it, as around any filter by names.
• These protections decrypt nothing: only the names and the addresses answered are read, on the box. Only three options send domain names out, and each can be turned off: the second opinion (a suspicious domain, alone, to learn its age), the reputation of the domains (the registrable domain of the names the household does not know well) and the collective base (registrable domain names only, off by default).
• Decide on each alert (subscription, beta): accept the risk (the allow that fits it), refuse it (the block, or the quarantine of the device) or keep watching it (told again at most every 14 days while it goes on); each decision is dated, written to the log and undone in one click. A device whose day is far busier or quieter than its habits raises an alert too.
• Leaks told by the record types (beta, free, from Warda 0.9.10): beside the shape of the names, Warda watches the kind of records a device asks; a burst of rare records (TXT, NULL, MX, ANY…) carrying data to one domain is stopped for that device, while the mail servers that check SPF, DKIM and DMARC are left alone.
• Devices that may use another DNS (beta, free, from Warda 0.9.10): a device present on the network that never asks Warda, or stopped asking it, is listed with what to check (private DNS, VPN, iCloud Private Relay, secure DNS of the browser, IPv6 DNS of the router), and raises an alert once a day. Warda cannot see the queries sent straight to another server: closing ports 53 and 853 in the router does.
• A licensed list of child sexual abuse material (beta, free, from Warda 0.9.10): an organisation that holds a licence from an authorised body, such as the IWF, can give Warda the address of its hashed list; it is downloaded over HTTPS, applied to every device and never readable on the box. Warda itself holds no such list.
• Analyze a domain (beta, free, from Warda 0.9.10): from any line of the query log, Analyze asks Warda's analysis service about the domain — only the domain leaves the box — and gives its verdict (malicious, suspicious, trustworthy or unknown), a score out of 100, the reasons and the age of the domain. A harmful domain is proposed to the Warda team for the shared lists, never added by itself: every box blocks it once the team has checked it. On your own box, you decide: block it or allow it. Up to 20 analyses an hour.

DNS exfiltration: what Warda detects

← Previous: Blocking Next: Learning →

Learning

• Warda learns from the requests of your network, at three levels: low, medium, strong.
• Each suggestion comes with its context: the device, the time, the request that came just before.
• An "Watched names" tab shows each suspicious name Warda is watching and why it is not suggested yet: first days of observation, score below your level, asked only by new devices or by servers, weekly limit reached. An analysis can be run on demand. A chart places each name against the thresholds of the three levels (low 90 %, medium 70 %, strong 50 %), yours highlighted, with a detailed view by reason and by role.
• By default nothing is blocked without you: suggestions are grouped in a weekly summary.
• Confident new trackers blocked automatically (option, beta, free; at the level strong only): the new tracker and telemetry names Warda is surest of — TVs and connected objects send a lot — are blocked by themselves, a few a week at most, never a site you use or have allowed. Each one is listed and undone in one click, and is then never blocked automatically again.
• The collective base (subscription, beta), off by default: once an administrator turns it on, Warda asks Warda's analysis service for its opinion on the names it doubts, like an EDR asking its cloud for a second opinion. The opinion (clean, suspicious or malicious, with its reasons) shows on the suggestions, and the dangerous names seen on your network come back as suggestions marked “Collective base”. Nothing is ever blocked without you.
• Only registrable domain names leave the box, never a device, a person, a time or an address, and the analysis service never learns which box asks. The dashboard shows the collective base at work: last exchanges, opinions received over 7 days, state of the analysis service.
• Model of the learning (beta, free, from Warda 0.9.10): the box can use a small model trained on the decisions of the administrators of many Warda boxes. It raises or lowers how sure Warda is of a name, and can propose a suspicious name the rules miss — always explained (what weighed most), never applied without you, within the same weekly limit. The model is downloaded signed and runs on the box: nothing of your network leaves it for that.

← Previous: Security Next: Family →

Family

• One card per person, with their devices, and profiles adapted to their age.
• Children become teenagers at 15 and adults at 18, automatically.
• A device shared by several people of the household follows the most protective profile of those who use it; its time and its activity are shown as “shared device” and count against nobody's personal total.
• A pause for one device or for the whole house, without letting through what stays blocked for the others.
• An account for each adult, with a clear dashboard; an adult who did not agree to detailed reports still counts in the totals, but the names they visit stay private.
• The query log shows the person behind each device, or else its group, and filters by person or group. Every account can open it: a member sees only their own devices, the administrators see everything.
• Easy to read for everyone: long lists by pages of 10 to 100 lines, one row out of two lightly shaded in the list of devices, a soft colour for each person and each group.
• Protection outside the home (subscription, beta): a phone, tablet or laptop keeps its rules on mobile data and on other Wi-Fi networks — the online service of Warda passes its queries to your box, which answers with the rules of that device. A profile for iPhone, iPad and Mac, an app such as RethinkDNS or Intra on Android, a setting in Windows 11 and in the browsers. When your box cannot be reached, the queries are answered without your rules (by a resolver that blocks known malware), and counted.
• Mobile data at home (subscription, beta): when a child’s phone protected outside the home switches to mobile data just after being on your network, the parents are told; Warda cannot tell whether the child is still at home or has just gone out, and says so. If another of the child’s devices stops asking Warda at that moment, Warda says it probably uses the shared connection: a likelihood, not a proof.
• The summary of the week (subscription, beta), for the children, the teenagers and the adults who agreed to detailed reports, kept 52 weeks and sent every Monday by e-mail through your own mail server, never through the online service of Warda; school holidays chosen by school zone where the country has them (France A, B, C).

Parental control at the DNS level: how it works

← Previous: Learning Next: Encrypted DNS →

Encrypted DNS

• Requests to the Internet encrypted by default (DNS over HTTPS or TLS), validated with DNSSEC.
• Your devices can speak to Warda in DNS over HTTPS, TLS or QUIC, with a name and a certificate given for free by Warda.
• If one of our domains ever became unavailable, Warda would switch by itself to another of ours, on an order signed by us, and would tell you if your devices need its new name.
• As soon as the box has its name and a valid certificate, the interface of Warda switches by itself to HTTPS at the name of the box, with no warning from the browser; if the certificate lapses, it comes back by itself to what it did before.
• If Warda stops, the Internet keeps working without filtering, and you are told.
• A step-by-step guide for each kind of device (Android, iPhone, Mac, Windows, Linux, browsers), one click away in the interface; every 15 minutes a probe checks each protocol for real.

← Previous: Family Next: Network →

Network

• An optional DHCP server, IPv4 and IPv6, with reserved addresses and local names.
• Local DNS records for your own services.
• The local names nobody on the network knows (nas, .lan, .home…) are answered by Warda itself and never sent to the Internet: the names of the house do not leak. Outside the home, a device protected through the online service gets no answer for them, nor for the local records and the names of the devices: they work at home only.
• The local domain is yours to choose: .lan, .home.arpa, .internal, .local or a domain you own. Warda warns without refusing: .local is also the domain of Bonjour (mDNS), so some devices may answer these names slowly, and a domain that exists on the Internet is answered by Warda for the devices of the network.
• A check of the network every 5 minutes: the box that announces its own IPv6 DNS server and the devices that never ask the filter are found, with a guide box by box (Freebox, Livebox, Bbox, SFR Box, Synology…) and in the assistant; a device with its own DNS on purpose (printer, camera) can be ignored.
• A plan of the network in colour that fits the screen, on a phone as on a computer: the box, the switches, the Wi-Fi access points and the devices on each, an icon for each kind of machine, the Internet box and Warda highlighted, the links coloured by type and state, and a legend; with a managed switch (SNMP, read only), each device is placed on its port and under its access point.
• The maker of each device from the three IEEE registries, and names for the phones with a private address: the name they give the box when they join the Wi-Fi, else their system (Apple device, Android phone with its maker, Windows computer). The makers are downloaded again every day with the lists, and virtual machines and containers are named as such.
• A kind for each device, with its icon: phone, tablet, computer, server, firewall or router, access point or switch, printer, television, game console, smart speaker, camera, connected object, storage (NAS), watch. Warda suggests it from what it detects (maker, system, name) and never overwrites your choice; the list filters by kind. The system of a phone with a private address is recognised from the names only that system asks, never guessed from its address.
• One device per machine: a machine seen twice (a new IPv6 address, another name given by the router) is merged by itself, and the names drop the local domain (nas.home.lan becomes nas); a merge can also be done by hand.
• The dashboard tells what happened: the health of the box live, with bars that turn orange then red as the processor, memory, storage or temperature rise, the load and network traffic over the last hour in charts; and on the activity chart, a mark for each alert, update and restart, at its time; each figure of the protection has its icon, and in the reports the hours of activity go from green to red, the busiest ones seen at a glance. The activity chart also marks the updates of the lists and the sites of the monitored categories; in the reports, half rings on the figures, the types of queries of each device and a map of the world drawn on the box.
• Internet boxes of 45 providers across Europe (EU, UK, Switzerland, Norway) and 21 families of home routers, mesh systems included (Deco, Orbi, Velop, Nest Wifi, eero, UniFi…), recognised by the assistant: it says where to set Warda as DNS server, shows the box behind your own router (double NAT), and tells you when it is better to let Warda give the addresses.
• Other networks of the place (beta, free): the VLANs of the guests, the cameras or the connected objects are declared in two fields (a name, a range); Warda answers them, scans their machines with the network of the box and names their devices after them, and suggests the networks it sees asking without being declared.
• A list of devices that stays clear (beta, free): delete a device, several at once, or in one go those known only by IPv6 or not seen for a number of days; Warda counts them first. The query log of a deleted device goes, its counts stay in the statistics; the box itself is never deleted.
• A query log that keeps up with a busy network (from Warda 0.9.10): with millions of queries the lines show at once, the count comes a moment later, and the pages never read the whole journal.

Block outgoing DNS on the router

← Previous: Encrypted DNS Next: Small businesses →

Small businesses

• Groups of employees and servers, with rules for everyone.
• Global activity log and alerts on sensitive categories.
• Administrator or Member on every plan. With Warda Business, groups of accounts, each given roles from a catalogue (accounts and groups, backups and restore, network, everyday management, reports and logs, read-only…); nobody gives a right they do not have, and every change is written to the activity log. The emergency account can never be deleted nor demoted: only administrators can reset it.
• Unblock requests (beta): an employee picks a name blocked on their device, asks for 15, 30, 45 or 60 minutes or for good, and says why; an administrator approves or refuses from the dashboard, with a comment, and the history keeps every request. Threats are never unblocked this way. If the administrator allows it (off by default), the person in front of the block page can also unblock a site for 15 minutes on their device after choosing why, a few times a day; each unblock is logged and raises an alert.
• Export to your SIEM (Wazuh, Graylog, Elastic, Splunk, Sentinel): alerts, administration log and names blocked, over syslog in JSON or CEF.
• Data loss prevention (DLP, beta), at the DNS level: file transfers, personal storage, paste sites, anonymous file hosts, personal webmail and AI assistants, each set to Allow, Alert or Block for the network, a group, a person or a device. A report by channel, device and person, the events sent to your SIEM, and a text ready to inform the employees, as the law requires.
• Security center (beta): a score out of 100 with its trend over 7 or 30 days, and the actions to take in order of priority, each with its button to fix it: devices infected or in quarantine, look-alike names, backups missing, administrators without a second factor, updates waiting…
• AI services (beta): which assistants are used, by which device and person, and since when; allowed, reported or blocked for the network, a group, a person or a device, all together or one by one (allow ChatGPT, block DeepSeek).
• Device policies (beta): the rules of each group of devices in one table (protections, SafeSearch, services, DLP, baseline rules), and a compliance list: devices given to nobody, silent, trying to go around the filter, in quarantine.
• Directory (beta): the people of Active Directory or OpenLDAP (LDAPS or StartTLS), of Microsoft Entra ID or of Google Workspace imported every hour, the groups of the directory matched with groups of devices. They sign in to Warda with their directory password, or with “Sign in with Microsoft” or “Sign in with Google”, and the groups of the directory give their rights; a person disabled in the directory is signed out at the next import. The accounts of Warda keep their own password, should the directory not answer.
• Company reports (beta): a summary of the week or of the month, ready to print: queries, blocks, security score, alerts, DLP and AI, by person and by kind of device; they open at once, computed every hour or on demand. With the logo of the company, also shown on the block page and the unblock page.
• High availability (beta): two boxes paired and one shared address, IPv4 and IPv6 (VRRP, keepalived): if the first stops, the second answers in its place, with the settings copied every minute, and the administrators are told. The secondary is read-only, so nothing is changed on it by mistake; the reports of the primary count both boxes; if the primary is lost for good, the secondary replaces it in one click. The second box also takes over the protection outside the home.
• Sites (beta): the boxes of distant sites join with a code and are followed from one manager box. From the head office, one policy for every site (company rules, data loss prevention, AI services, device policies), signed by the manager and checked by each box, local exceptions allowed or not; every site, or some, updated at once to the latest signed release; one report of the company that adds up the counts of every site, never a name; and an alert when a site goes silent for a day.
• Web proxy (beta, off by default): an explicit proxy in the box, announced to the computers by the network (WPAD) or set by a company policy. Every site they open is decided by the same rules as the DNS, even in a browser with its own encrypted DNS; with one firewall rule (ports 80 and 443 out for the box only, QUIC refused) it becomes the only way out. Each connection is logged with its site, device and volume, and the AI services, file sharing and webmails in use are shown per device — read from the name in the TLS handshake: nothing is decrypted, everything stays on the box. Apps of phones and objects often ignore proxies: the DNS filter keeps protecting them.
• Alerts of the pair and of the sites on the phone (beta, from Warda 0.9.10): the administrators are told by a push notification when a box of the pair takes over, when the other box is lost, when the main box was replaced, or when a site goes silent — even when the box that stopped is the main one.

DNS filtering for a small business: how it works

← Previous: Network Next: Blocking →