What is Warden
Warden is a DNS filtering server. It sits between the devices on your network and the wider internet and decides, query by query, which domain names resolve and which quietly disappear. Ad networks, behavioural trackers, malware and phishing hosts are all reached by domain name — name a domain in a blocklist and the lookup fails, so the connection is never made.
It’s written in Rust, so the core is memory-safe by construction. The resolver is hardened against the usual DNS abuses — tunnelling, amplification, cache poisoning — and runs locked down to the handful of privileges it actually needs.
Beyond security, Warden is built to run light. It ships in several install formats and has been tested across a range of hardware, so it fits whatever you already have at home or in the office.
One install, every device covered
Browser ad-blockers stop at the browser. Warden works at the network level — phones, smart TVs, game consoles, IoT toys, anything that joins your wifi.
Most unwanted traffic on a network no longer comes from a browser. It comes from apps that ignore your privacy settings — smart speakers, consoles, printers, TVs quietly sending data back to their makers and to analytics companies.
Warden catches all of it from one place. Point your router’s DNS at the machine running Warden and everything downstream — every device, every app, every guest — is filtered automatically. No browser extensions, no per-device setup, nothing for anyone to install.
Different rules for different scenarios
The kids’ tablets get strict filtering, your laptop gets none, the office blocks streaming during work hours. One Warden, many policies.
Real networks aren’t a single policy. In a house, adults want one set of rules, kids want another, and the guest wifi might want a third. Warden calls these profiles: named bundles of rules you assign to whichever devices you choose.
The same engine scales into an office. The finance team, the shop floor, reception’s guest wifi and a rack of kiosk tablets each want their own rules — so group devices however your network is already carved up, by static IP, MAC address, SSID or whole subnet, and point each group at a profile. Each profile combines community blocklists, custom rules and time-of-day schedules to fit that group.
Your data, your privacy, your hardware
Cloud DNS-filtering services see every site you visit. Warden runs on your own hardware, in your building. The record of who-asked-for-what never leaves the box.
Hosted DNS-filtering services work by sending every lookup your devices make to their servers. They do a good job at filtering, but in exchange they get a real-time stream of the sites your family visits.
For a business the stakes are the same, only sharper. DNS logs are a map of what an organisation is doing — which suppliers it talks to, what it’s researching, which services each department leans on. Hand that stream to an outside service and you’ve handed over a behavioural profile of the whole company.
Warden is the same idea on your own hardware — same community blocklists, filtering just as thorough. The difference is where the data lives: on a machine you own, behind no one’s terms of service. No account, no subscription, no telemetry. Whether it’s a family’s browsing or a company’s behavioural detail, the record stays inside your walls.
One config file, versioned and portable
One TOML file describes what Warden does — commit it to git, copy it to a new box, restore it after a failure. A small TUI lets you look inside; no web panel runs around the clock just to draw a chart.
Keeping the whole state in one text file is drawn straight from how Warden is used — homelabs, small offices, security-conscious setups where the config has to be auditable, not a user clicking through a wizard. Those operators keep their tools predictable and don’t want a web service hanging around just to draw a graph once a month.
Because the config is a single TOML file, it behaves like any file you already trust. Keep it in git and diff it between releases. Copy it to a new box for an identical setup in seconds. Recovery after a failed disk or a bad change is a restore, not a rebuild — which matters most on the day something breaks.
Inspection happens through a TUI you launch when you’re curious and close when you’re done. Nothing runs unless it has to.
Part of an ecosystem
Warden is one piece of purge.cc — the same project that curates the blocklists. Free, open, and built to work together. None of it locks you in.
Warden comes from purge.cc, a project building a complete, free, open way to filter what a network reaches and raise its baseline security — no subscription, no vendor in the middle. purge.cc curates the blocklists; Warden enforces them. Sixteen ready-made purge.cc lists ship in the built-in catalog, so a useful setup is a few lines of config away.
None of it is a closed loop. Warden reads domain-only lists, AdGuard-style syntax and plain hosts files, so you can use the purge.cc catalog, point it at someone else’s lists, mix them, or bring your own — same result either way. You lean on the ecosystem because it’s convenient, never because you’re stuck in it.
Where Warden fits
Warden is the DNS filter — one layer of your network’s defence, not the whole of it. A few related things sit out of scope on purpose.
Warden is one brick in the wall, not the wall. It filters DNS — a real, useful layer — but it isn’t a firewall or a complete security strategy on its own. It sits alongside the rest of what keeps a network safe: a firewall at the edge, sensible device hygiene, backups. Knowing what Warden doesn’t do is part of using it well.
- Not a firewall. Warden decides which names resolve; it doesn’t inspect packets, open ports, or police traffic. Keep your firewall — Warden sits behind it, doing a different job.
- Not a recursive resolver. Warden forwards every allowed query to an upstream of your choice — Quad9, Cloudflare, your ISP, Unbound on the same box. The split keeps Warden small and lets mature resolvers handle what they’re already good at.
- Not a content filter. Once a domain is allowed, what travels over the connection is out of view. For URL-level or page-level filtering, you want a different kind of tool.
- Not a VPN. Warden protects the question your device asks; it doesn’t tunnel the answer. Pair it with a VPN if that’s the layer you also need.
The reasoning behind each — and the deeper design choices — is in Project principles and Security by design.