Quick start

Under review — wording may still change.

The fastest path from zero to a network that blocks ads and trackers on every device.

Warden filters DNS: it sits between your devices and the internet, answering name lookups and dropping the ones that belong to ads, trackers, and malware. Getting there is three stages — install it on one always-on machine, point your network at that machine, then confirm. Installing changes nothing on its own; your network stays exactly as it is until stage 2.

You’ll need one Linux machine that stays on — a spare PC, a home server, a Raspberry Pi. This is the machine that runs Warden; the rest of this guide calls it your Warden machine. Set aside about ten minutes.

1. Get Warden running

Install the package for your Warden machine’s operating system. Each guide is a short, five-step install that ends with Warden filtering locally:

Debian / Ubuntu — install from the .deb
Fedora — install from the .rpm
Any other Linux (Arch, openSUSE, Raspberry Pi OS, …) — build from source

You’re done with this stage when Warden reports it’s up and filtering. Ask it directly with the CLI — these commands run on the Warden machine itself, not from another computer:

on the Warden machine

$ warden status # is the daemon up? $ warden query doubleclick.net # → BLOCKED (an ads list caught it) $ warden query google.com # → ALLOWED

warden status confirms the daemon is running; warden query asks it whether a domain would be blocked and names the list that caught it. For a live view — queries, blocks, top domains — run warden dashboard to open the terminal UI.

Choose your blocklists now

Warden already blocks ads, trackers, and malware out of the box, so there’s nothing you must do here. To pull more lists (or fewer), browse the catalog with warden lists catalog and subscribe with warden blocklist add <id>. See Blocklists for the full picture.

That proves Warden works — but only for the Warden machine. Stage 2 extends it to everything else on the network.

2. Point your network at it

A device is protected the moment its DNS queries go to your Warden machine instead of straight to your ISP. There’s nothing more to install — you’re only changing where lookups are sent, so that everything flows through Warden on its way out:

Your devices

Warden

The internet

Every lookup on the network passes through Warden before it reaches the internet

There are two ways to redirect those lookups.

Whole network (recommended)

Set your router’s DNS to the Warden machine’s IP. Every device that gets its network settings from the router then uses Warden automatically — no per-device setup.

Warden is ready for this out of the box: the default config listens on every interface and already accepts every device on a private home network, so there’s nothing to change on the Warden side.

Open your router’s admin page — often http://192.168.1.1.
Find the LAN or DHCP settings. The DNS field you want is there, not in the WAN / internet section.
Set the DNS server to the Warden machine’s IP address.
Save, then reconnect a device (or reboot it) so it picks up the change.

Example on a typical home router:

text

Router admin  →  http://192.168.1.1
  LAN / DHCP settings
    DNS server  →  192.168.1.10        # the Warden machine's IP
  Save, then renew the lease on a client

Router menus vary — if you don’t see “DNS” under LAN or DHCP, check your router’s manual for where it sets the DNS handed out to clients.

A backup resolver — choose it deliberately

Once the whole network points here, your Warden machine is a single point of failure: if it’s switched off or the service stops, nothing on the network can resolve names and browsing halts. A resolver in the router’s secondary DNS field prevents that — but the choice is a trade-off:

Best — a second filtering resolver. Another Warden install (or another DNS filter) keeps ads and trackers blocked even while the primary is down.
Acceptable — a public resolver (1.1.1.1, 9.9.9.9). It keeps the internet working, but it does not filter: devices may use it at any time, and those lookups skip Warden, so some filtering leaks. A fair trade for uptime — just make it knowingly. Warden’s anti-bypass settings narrow that gap, but don’t fully close it.

Prefer no leak at all? Leave the secondary blank and accept that the network leans on this one machine.

Give the Warden machine a fixed address

Assign the machine a static IP, or reserve its address in the router’s DHCP settings. If its IP later changes, the router keeps handing out the old one and the whole network loses DNS until you fix it.

One device (to test first)

To try Warden on a single machine before switching the whole network, set just that device’s DNS to the Warden machine’s IP:

macOS / Windows / Linux — network settings → DNS servers → the Warden machine’s IP.
Phone — Wi-Fi network → configure DNS → manual → the Warden machine’s IP.

Revert it the same way if anything misbehaves; nothing else on the network is affected.

Unusual LAN, or want to restrict access?

The default accepts the standard private ranges (192.168.x, 10.x, 172.16–31.x). If your network uses a different range, or you want to allow only some devices, edit server.allow_from — see Server globals.

3. Confirm it’s working

From a device you just pointed at the Warden machine — not the machine itself:

Browse a few ad-heavy pages. Ad banners on many sites should come back blank, and pages often feel snappier.
Or check a lookup directly, naming the Warden machine as the resolver:

from a phone or laptop

$ nslookup doubleclick.net 192.168.1.10 # → 0.0.0.0 (blocked, via Warden)

If it still returns a real address, that device isn’t using the Warden machine yet — recheck its DNS setting and reconnect it to the network.

The Warden machine is now your network's resolver

Once the router points at it, every lookup on the network goes through this machine. If it’s powered off or the service stops, the network loses name resolution until DNS is restored. Test on one device first, and keep a note of how to change the router’s DNS back.

Next steps

Warden is filtering with sensible defaults. From here you can tailor it:

Profiles — different filtering for kids, guests, or work devices.
Blocklists — subscribe to more lists, or add your own.
Devices — pin a specific device to a profile.