Every device home.
One guardian.

Warden runs on a Raspberry Pi, a VM, or the NAS you already own and filters DNS for the whole house — trackers, ads, and malware gone before a device even connects. No cloud, no account, no per-device setup.

Your hardware

A Raspberry Pi, a VM, a NAS, or the home server you already run. Warden ships for Linux amd64 and arm64, so whatever hums in the corner of your rack is good enough — no new hardware to buy.

Featherweight

One single binary with no runtime to install. It idles next to your other services until you look at what it blocks.

Whole-home

Point your router at Warden once and every device is covered: phones, laptops, TVs, consoles, and the IoT gadgets that can't run an ad-blocker. One resolver for the whole house.

Privacy first

No cloud, no account, no telemetry. Your rules, blocklists, and query history stay on your hardware — you hold the keys, and nothing about your network ever leaves home.

Per-person control

Everyone under
one roof.

One network, many people. Each gets their own rules — the kids' tablets locked down, your work laptop wide open, guests kept to themselves.

warden  ·  dashboard live

Per-person profiles

One policy per person.

Each profile picks its lists, exceptions, and block-all. Unknown devices take the default profile — or get refused if you leave it unset.

source src/config/schema/profile.rs

SafeSearch on the kids' profile

Google, YouTube, Bing, DuckDuckGo.

One switch on a profile forces the family-safe variants. Attach the adult or gambling list to that profile if you want those blocked too.

source src/profiles/safesearch.rs

Bedtime is bedtime

Homework hours, enforced.

A schedule swaps a device or group onto another profile by time and day of week. Nights, school hours, weekends. Midnight wrap included.

source src/config/schema/schedule.rs

Guest Wi-Fi, its own profile

Visitors, walled off.

Attach a profile to the guest subnet. Visitors get filtered DNS without inheriting your exceptions. Hand out the Wi-Fi without handing over your rules.

source src/config/schema/subnet.rs
Your LAN, your names

Home names
stay home.

nas.home, printer.home — names you define are answered on the LAN and never queried upstream.

Custom hostnames

Name your boxes.

Create internal aliases — nas.home, printer.home — as A, AAAA, or CNAME. Stop memorizing IP addresses.

source src/dns/local.rs

Per-profile names

The homelab, not the guest Wi-Fi.

The same name can resolve differently per profile — nas.home on the homelab profile, nothing on the guest one.

source src/config/schema/profile.rs

Reverse DNS for those names

PTR, generated.

Every local A or AAAA you define gets an automatic PTR. Reverse lookups for those records read in names, not numbers.

source src/dns/local.rs
Operations & visibility

See everything.
Break nothing.

Every query, every device, in the TUI — plus a config backup, so rebuilding after a tinker gone wrong is a restore, not a rewrite.

Live query log

Nothing's a black box.

See requests as they land: who asked, which domain, allow or block. Can be off, blocked-only, or sampled.

source src/tracking/query_log.rs

Per-device volume

Know each device.

Queries today, block %, and a 24h series for every client. Spot the chatty smart TV. Top domains stay network-wide.

source src/tracking/engine.rs

Top blocked

The wall of shame.

A live ranking of blocked domains across the network — a quick read on how hard the lists are working.

source src/tracking/top_n.rs