Warden is the self-hosted DNS filter for the organization — phishing, malware, and trackers dropped before a connection is even opened. On-prem or in your private cloud. No cloud account, no per-seat fees.
warden
One static binary on a VM, bare metal, or a container host you already run — Linux amd64 / arm64. No appliance to buy, no agents on endpoints.
On-prem or private cloud. DNS logs are personal data under GDPR — Warden's never leave your perimeter. No telemetry, no account, nothing phones home.
The whole configuration is one declarative TOML file: version it in Git, review it in pull requests, restore it with one command.
AGPLv3 — no per-seat licensing, no subscription, no lock-in. Your security team can audit every line.
Every device must resolve DNS — filter there and trackers, cloaked CNAME hops, and DNS tunnels die before the first packet. No endpoint agent, and it covers the devices you can't manage: contractors' laptops, IoT, printers.
Follow the alias chain.
Trackers disguised as first-party domains followed hop by hop — up to 16 — and blocked anyway.
sourcesrc/filter/cname.rs
A feed cannot un-block itself.
Lists you subscribe to cannot smuggle an allow, $important, or regex. Only the rules your team writes get those powers.
sourcesrc/lists/parser.rs
Exfil does not look like DNS.
A burst of unique, cache-missing names under one domain is the usual shape of DNS exfil. Warden refuses those queries. On by default.
sourcesrc/security/tunneling.rs
IoT and OT, locked down.
Set block_all on a profile and only admin allows get through — printers, cameras, building kit stay on the names you wrote.
sourcesrc/config/schema/profile.rs
Finance, engineering, the guest Wi-Fi. Each group gets its own rules, applied at the device, group, or subnet.
Blocks, exceptions, schedules.
A group of devices shares one profile — lists, exceptions, block-all. Attach a schedule to the group when the window matters.
sourcesrc/config/schema/group.rs
A CIDR is a VLAN, here.
Map a CIDR to a profile. Staff, guest, IoT, OT — each range gets its own rules. Longest prefix wins.
sourcesrc/config/schema/subnet.rs
Opt-in DNS.
Leave the default profile unset and anything you have not mapped is REFUSED. Guest phones and new IoT get no DNS until you say so.
sourcesrc/dns/handler.rs
The corporate domain stays internal.
Send a zone to another resolver — corp.example.com to the DCs, everything else through Warden. Longest suffix wins.
sourcesrc/upstream/forwarding.rs
Filter without recording lookups, or keep a full log. Config changes write an audit trail. Metrics if you turn them on — no new database.
Privacy stays on.
Filtering stays active if you turn query logging off — or keep blocked-only / sampled. Lookups are not a required audit of people.
sourcesrc/config/settings.rs
Who changed the config.
One JSON line per reload, boot, shutdown, and mutation — uid, files, before/after SHA-256. warden audit tail reads it.
sourcesrc/config/audit.rs
Opt-in. Off by default.
OpenMetrics on /metrics when the API is on and metrics are enabled. No exporter sidecar. Off by default.
sourcesrc/api/routes.rs
Amplification, throttled.
Per-client budget inside allow_from; per-prefix outside it. Spoofed sources get dropped or slipped to TCP. On by default.
sourcesrc/security/rrl.rs