WOMBATS Shield
Order
Threat model

What Shield protects, and where it deliberately stops.

A network appliance is only as trustworthy as the boundaries it's honest about. Here's where Shield is designed to be effective, and the cases we deliberately don't pretend to cover.

What Shield protects against

Ads & ad networks

Network-wide blocking of known ad and ad-network domains across every device on your network.

Trackers & profiling domains

Reduces unwanted cross-site tracking before the connection is made, including from devices that have no built-in blocker.

Phishing & malware domains

Blocks known harmful domains at the DNS layer before traffic ever leaves the network.

Adult & unsafe content

Optional category-based blocking with SafeSearch enforcement on Google, Bing, YouTube, DuckDuckGo and the other supported search engines.

App & service blocking

Catalog-based blocking for supported apps and services, useful for parental and household controls.

DNS bypass paths

Local nftables enforcement resists common encrypted-DNS bypass tricks and Apple Private Relay traffic.

Where Shield deliberately stops, and why

Shield is a network‑level appliance. It is honest about what a network‑level appliance can and can't do, so you know when to reach for something else.

Devices outside your network

A phone on mobile data, a laptop on a café Wi-Fi, an IoT device on a separate network — by default, none of those are on your Shield, so its policy doesn't apply. We don't pretend otherwise. Shield Vault has two calm answers: travel Wi-Fi when the household is away together, and Follow-Me Filtering, where a phone connects back to your Shield through a free app so your rules follow it. Honestly stated: the phone's owner can switch that connection off — your Shield shows when each phone last connected.

VPNs and encrypted DNS on managed devices

A VPN tunnels traffic past local DNS. So does encrypted DNS on a determined device. Shield blocks common bypass paths and Apple Private Relay, but a determined user on a managed device can still tunnel out, what we give you is visibility, not coercion.

Universal app inspection

Shield filters at the DNS layer and at the network layer. It does not deep-packet-inspect every app or break TLS to read inside encrypted connections. We think that's the right boundary for a calm home appliance, but it means some app behaviour is opaque to Shield by design.

Hostile WAN exposure

Shield is designed to sit behind your modem on a normal home or office network. It is not hardened for being directly exposed on the public internet. If your network setup is unusual, talk to us before deploying it.

Endpoint security on the device itself

Shield protects the network. It is not anti-malware on your laptop, your phone, or your Mac. The two layers complement each other, but Shield is not a substitute for keeping endpoints up to date.

What stays local

Filtering decisions, they happen on Shield
Per-device policy and pause controls
The local web management UI
Internet pause and category exclusions
Encrypted local storage, switched on at setup (Vault)
Time Machine backup target (Vault)
Vault Wi-Fi access point clients (Vault)

What we don't store

Shield does not maintain a browsing-history report, a behavioural-profiling dashboard, or a query-log feed back to us. Several AdGuard Home defaults that would have produced these by accident have been disabled or restricted in our build, that work is part of what makes Shield an appliance and not a hobby image.

A promise you can check

No trackers here, either.

This website has no Google Analytics, no Meta pixel, no ad trackers, and no tracking cookies. It makes no requests to advertising or social networks. The one measurement we keep is a simple, cookieless page counter served from our own address — it counts visits, and it cannot follow you anywhere.

The same is true of the Shield's own dashboard: it runs in your house and calls no third parties at all.

Don't take our word for it. Open your browser's developer tools, look at the Network tab, and reload this page. What you see is everything we load.

What may use external sources

Local‑first does not mean sealed off from the internet. Some functions reach out so the system stays useful and current. We list them so you know exactly what does and doesn't leave your network.

Website lookups

Handled, wherever you are.

Every device has to ask where a website lives before it can go there. That question has to leave your home, and who hears it depends on where you are.

At home, your Shield asks the internet's own address servers directly. No DNS company builds a picture of your household. Your internet provider can still see the names as they pass, as it always could.

On hotel, café or airport Wi-Fi, the risk is the network you are borrowing. There your Shield sends the question as an encrypted lookup to a provider you choose — Cloudflare by default — so that network cannot read your lookups. Worth saying plainly: encryption hides the questions, not the destinations. Any network carrying your traffic can still see where it ultimately goes; what it loses is the running list of everything you ask.

You do not set any of this up. Shield follows your Wi-Fi settings and switches by itself. If you would rather decide, you can pin it to the Shield or to an external provider at any time.

Architecture in one paragraph

The shape of Shield, from the outside in.

Shield is built on Raspberry Pi 5 silicon (2 GB on Core and Edge, 4 GB on Vault) with a Debian 12 base. AdGuard Home provides the DNS-layer filtering engine, with restricted defaults to match our privacy goals. nftables enforces network policy on the device. Software updates land as complete, signed bundles that are verified before they're applied. Shield's encrypted partitions are unlocked at boot through a hardware-assisted key path burned into the board's own one-time-programmable silicon, bound to the device. On Shield Vault, the encrypted storage SSD is separate from the system partition and can be unlocked three independent ways: a silicon-bound auto-unlock key used at boot, a user passphrase, and a recovery key.

For the disclosure policy and the deeper security story, see /security. If you believe you've found a security issue, write to security@wombatss.com.