What is Warden
Warden is a DNS filtering server. It sits where a Pi-hole would sit: it is the resolver your LAN talks to. Devices send their DNS queries to Warden, not to the internet. Names aimed at ad networks, trackers, and malware stop here — Warden answers them itself. Everything else is forwarded to an upstream resolver you choose. Warden does not recurse, and it never sees the page.
WardenIt is a single open-source binary. No account, no subscription, no vendor lock-in. The policy you write stays on a machine you own.
One install, every device covered
Browser ad-blockers stop at the browser. Warden works at the network level — phones, smart TVs, consoles, IoT, anything that joins your wifi.
Most unwanted traffic no longer comes from a browser. It comes from apps that ignore your privacy settings. One Warden covers the whole LAN.
Different rules for different devices
Kids’ tablets get a strict profile. Your laptop gets another. The office can block streaming during work hours.
A profile is a named bundle of lists and rules. You point devices, groups, or subnets at a profile. How the resolver picks one, and in what order, is the filtering process.
Your data stays on your hardware
A hosted DNS filter sees every site you visit. Warden does not phone home.
Cloud filters work by sending every lookup to someone else’s servers. That stream is a map of a household or a company. Warden runs on your own box. No telemetry. The record of who-asked-for-what never leaves the machine. Why that is a design constraint, not a feature: Project principles.
One config file
One TOML file is the whole policy — commit it, copy it, restore it.
There is no wizard state and no web panel that has to stay up. Inspect with a TUI you launch and close. How the file is the source of truth: Declarative configuration.
Part of purge.cc
purge.cc curates the lists. Warden enforces them. Neither locks you in.
A built-in catalog points at first-party purge.cc lists. Warden also reads domain-only lists, AdGuard-style syntax, and hosts files, so you can mix the catalog with someone else’s lists or your own. Browse them with warden lists catalog. How to subscribe: Blocklists.
Where Warden fits
Warden is one layer of the network, not the whole defence.
| Warden does | Warden is not | Pair it with |
|---|---|---|
| Decide which names resolve | A firewall | The firewall at the edge |
| Forward allowed queries to an upstream you name | A recursive resolver | Quad9, Cloudflare, your ISP, or Unbound on the same box |
| Filter the name | A URL or page filter | A different kind of tool |
| Protect the DNS question | A VPN | A VPN, if you also need a tunnel |
The design constraints behind those limits: Project principles. The controls and the named threats: Security by design and the threat model.
To put a daemon on the LAN: Quick start.