Selfhosted

Hey c/selfhosted,

I've been building Wardnet, an open-source (GPL-3) network privacy gateway you run on your own hardware, a Pi, a mini-PC, any Linux box. Two things up front, since they're what set it apart from "your router already does this": It runs alongside the router you already have, you don't replace anything.

It's device-centric, not rule-centric: you open a device and pick where its traffic goes, instead of hand-writing source-based firewall rules and gateway assignments.

No cloud account, GPL end to end, nothing leaves your LAN unless you ask. One signed binary with the web UI embedded.

**Why I built it: **It started with a television. I wanted only the TV routed through a VPN, but a TV can't run a VPN client, and the "put it on the router" answer is a single switch for the whole house that breaks streaming and sends the doorbell to Amsterdam. I wanted per-device rules, decided in one place, so I built it.

What it does: Per-device VPN routing: send the TV through one WireGuard tunnel, your laptop through another, the printer direct. Applied via ip rule + nftables, instantly.

Network-wide ad/tracker blocking: DNS filtering, bring your existing Pi-hole blocklists, per-device filter profiles.

Your own local DNS: custom LAN records, conditional forwarding, and it can recurse from root + validate DNSSEC.

Network zones: drop IoT/guest/kids devices into locked-down zones enforced at the firewall (no admin-UI access, no bypassing a mandated tunnel), with exceptions for things like casting to a TV in another zone. Built-in DHCP, device discovery, encrypted backup/restore, and a layered watchdog that self-heals.

Free vs Premium (upfront): I know a paid tier on a self-hosted tool invites side-eye here, so plainly, the gateway is free and fully self-hostable forever: everything above, including automatic HTTPS when you bring your own domain. Premium is an optional add-on only for the parts that cost me money to run on your behalf (dynamic DNS, secure remote tunneling, roaming DNS) plus the mobile apps + push. Everything the mobile apps do is also free from the desktop admin site, they're convenience, not a functionality gate.

On the [AIP] tag: Wardnet is developed with AI assistance, and I keep a full declaration in the repo (ai-declaration.md) using this community's own Hint/Assisted/Pair/Generated levels, so you can weigh it rather than guess. Every line is human-reviewed before merge, and the same gates apply to generated and hand-written code alike: clippy at deny-warnings, full + e2e tests against a real kernel in Docker, cargo audit, CodeQL. The assurance I trust most: I run the same signed release as the gateway every device in my own house depends on.

Honest status: active development, daily-driven on a single Pi at home, expect rough edges. 64-bit only (aarch64 / x86_64). GitHub: github.com/wardnet/wardnet · Docs: wardnet.network

Would love feedback, especially from anyone already running a segmented network or per-device VPN setup.

Happy to answer anything