Quick start

Under review — wording may still change.

From zero to a network that blocks ads and trackers on every device.

one command

$ curl -fsSL https://get.purge.cc | sudo sh

Debian, Ubuntu, or Fedora. Other distros: build from source.

One always-on Linux machine — a spare PC, a home server, a Raspberry Pi. About ten minutes. The command installs the package and stops; nothing on the network changes until you point it here.

Prefer the package by hand? Debian / Ubuntu or Fedora.

Start the daemon

The installer leaves the service stopped on purpose.

Skip warden init. The package already created the system user, the directories, and a config with the default lists. Init is only for a source build.

#	Action
1	If `systemd-resolved` holds port 53 (Debian, Ubuntu, Fedora Workstation), free it — command below
2	Set `upstream.servers` with `sudo warden config edit`. The scaffold ships with none — Warden never picks one for you
3	`sudo systemctl enable --now purge-warden`

bash
printf '[Resolve]\nDNSStubListener=no\n' | \
  sudo tee /etc/systemd/resolved.conf.d/purge-warden-no-stub.conf
sudo systemctl restart systemd-resolved

Check the status

These commands run on the Warden machine itself.

on the Warden machine

$ warden status # is the daemon up? $ warden query doubleclick.net # → BLOCKED (an ads list caught it) $ warden query google.com # → ALLOWED

warden status confirms the daemon is up. warden query names the list that caught a domain. For a live view, warden dashboard. Ads, trackers, and malware are already subscribed — more lists: Import lists.

Point your network at it

A device is protected the moment its DNS goes to this machine.

Your devices

Warden

The internet

Every lookup on the network passes through Warden before it reaches the internet

Scope	What you change	When
Whole network (recommended)	Router LAN / DHCP DNS → the Warden machine’s IP	Every device that gets settings from the router
One device	That device’s DNS → the same IP	To try it first

On the router: admin page (often http://192.168.1.1) → LAN / DHCP DNS → the Warden machine’s IP. Save, reconnect a client. The field you want is the DNS handed out to clients, not WAN.

Give the machine a static IP, or reserve it in DHCP. If the address later moves, the whole network loses DNS.

On a single device: network settings → DNS servers (phones: Wi-Fi → configure DNS → manual). Revert the same way; nothing else is affected.

The default server.allow_from already covers the private ranges. A different range, or a tighter allow-list: Basic configuration.

A backup resolver — choose it deliberately

Once the router points here, this machine is a single point of failure. A second filtering resolver in the router’s secondary DNS field keeps ads blocked when this one is down. A public resolver (1.1.1.1, 9.9.9.9) keeps the internet up, but those lookups skip Warden. Leave the secondary blank if you want no leak.

Confirm it’s working

From a device you just pointed — not the Warden machine.

Ad-heavy pages should come back with blank banners. Or query through the Warden machine:

from a phone or laptop

$ nslookup doubleclick.net 192.168.1.10 # → 0.0.0.0 (blocked, via Warden)

If you still get a real address, that device is not using Warden yet — recheck its DNS and reconnect.

Next steps

Warden is filtering with sensible defaults. Tailor it from here.

Profiles — different filtering for kids, guests, or work devices.
Import lists — subscribe to more lists, or add your own.
Devices — pin a specific device to a profile.