Security & Privacy Pipeline

Flow: Left → Right

01 FIREWALL

nftables

Kernel-level packet filtering. Blocks malicious IPs and rate-limits abusers before they reach our stack.

UDP Rate Ceiling

Threat-Feed IP Blocking

Auto Bot Detection

02 FILTERING

AdGuardHome-edge

Query filtering with no cache of its own. Blocks ads, trackers, malware and phishing against four public blocklists, then passes everything else to the validating resolver.

Adware & Tracking

Malware & Phishing

No-Cache (Stateless)

03 CACHE & DNSSEC

Unbound DNS

Validating resolver. Cryptographically verifies DNSSEC signatures and serves hot records from its own prefetching in-memory cache.

DNSSEC Validation

Prefetch Caching

QNAME Minimisation

04 UPSTREAM

DNSCrypt-Proxy

Encrypted upstream transport. Every outbound query leaves over DNSCrypt or DoH, so nothing reaches the upstream resolvers in plaintext.

DNSCrypt + DoH

No-Log Upstreams

No Local Cache

Active IP Blocklists (nftables kernel-level)

We block these sources at the network edge. The list below is the set of feeds currently enabled.

Enabled Threat Feeds Active

FireHOL Level 1

The "Gold Standard" of IP blocklists. 100% malicious history.

Essential

Spamhaus DROP + EDROP

Hijacked networks used solely by professional cybercrime gangs.

Essential

BotScout + Blocklist.de

Decommissioned 7 July 2026. Disabled after crowd-sourced reports were found to poison the firewall with legitimate search engine crawlers (Googlebot, Bingbot). Behavioral protection is now handled exclusively by our local heuristics engine. Full incident writeup: When Your Blocklist Bans Googlebot.

Disabled (FP Mitigation)

Feodo Tracker

C2 servers for banking trojans (Dridex, Emotet, Trickbot).

Malware

ET Compromised

Emerging Threats list of hosts known to be infected.

Malware

DShield (SANS ISC)

Top attacking subnets reported by the global sensor network.

Attacks

GreenSnow

Decommissioned 7 July 2026. Our local honeypot ports and behavioral anomaly detection already block live scanners within seconds with local evidence, rendering third-party crowd-sourced feed blocks redundant.

Disabled (Redundant)

Local heuristics engine

Behavioural detection in place of crowd-sourced feeds. Auto-bans flooders and DDoS sources.

Local

DNS Filter Lists (AdGuardHome-edge)

Domain-based blocklists that filter ads, trackers, malware, and phishing at the DNS level. These work after traffic passes the firewall.

Counts measured 6 August 2026 - reopen the page to recalculate them live from the source lists in your browser.

261,790

rules blocked across all lists

Filter Source Live Sync

AdGuard DNS Filter

The baseline standard for blocking ads & general trackers.

163,297 rules filter_1.txt

OISD Blocklist Small

High-speed, essential blocking for maximum stability.

56,395 rules filter_5.txt

Phishing URL Blocklist

Real-time phishing & fraud domains from PhishTank and OpenPhish.

34,808 rules filter_30.txt

Malicious URL Blocklist

Active malware-distribution URLs tracked by abuse.ch URLHaus.

7,290 rules filter_11.txt

Rate Limiting & Fair Use

300

Queries / second

Per-IP rate limit on DoH. Sized for CGNAT networks, prefetching, and ad-heavy pages. Normal browsing does not come close to it.

Configuration last verified August 6, 2026

Protocols

How DoH, DoT, DoQ and DNSSEC validation work end to end.

No-logs policy

What we don't store, and how the RAM-only design enforces it.

Knowledge base

Answers on DNSSEC, filtering, GeoIP labels and troubleshooting.

Guides

DNS resolver

What a resolver is, and what it can see about you.

Caching & TTL

How the cache and TTL work, and why changes take time to spread.

Runbook

Build your own validating, hardened resolver with Unbound.

Transparency Report