masaleem-oss/Fengard

Kernel-enforced firewall and DNS filtering for any OpenWrt router.
One Go binary. Per-device profiles, screen time, a WireGuard VPN and a full dashboard.
Installs next to your router's firmware with one double-click. Nothing gets reflashed.

Parental controls, ad blocking and screen time for every device on your home network, running on the router itself: OpenWrt, GL.iNet and other OpenWrt-based routers. A self-hosted alternative to Pi-hole and AdGuard Home that kids can't get around by changing DNS.

Install · Screenshots · How it works · Features · Reference · Development

• Why Fengard
• How it compares
  • Memory
• Install
  • Which routers work
  • Supported routers
  • What the installer changes
  • Running on a computer instead
  • Uninstall
• Screenshots
• How it works
• Features
• Performance
• Configuration reference
• Security
• Troubleshooting
• FAQ
• Development
• Project layout
• Contributing
• License
• Star goals

Most home filtering is either a DNS server on a Raspberry Pi, which any device can route around, or a subscription box that replaces your router. Fengard does it on the router you already have:

• It can't be bypassed by changing DNS. Lookups sent to any other server are redirected back to Fengard, and DNS-over-HTTPS, DNS-over-TLS, DNS-over-QUIC and Tor are blocked in the kernel.
• Every device gets its own rules. Profiles carry blocked categories, blocked apps, SafeSearch, schedules and daily screen-time limits, and a person's limit is counted across all their devices.
• The kernel does the work. Filtering decisions live in nftables or iptables rules in Fengard's own table. If Fengard stops, it removes them and the router carries on as a normal router.
• It stays out of your way. It runs next to the stock firmware, installs and uninstalls in one step, and uses about 25 MB of memory.

Pi-hole and AdGuard Home are great DNS blockers. Fengard covers the same ground and adds the parts a family network needs, enforced by the router's firewall:

_{Based on each project's out-of-the-box features. Pi-hole and AdGuard Home can do more with extra setup.}

Routers don't have much of it, so this matters more than speed. With the same seven blocklists (534k domains), started cold side by side:

Fengard 1.3.1.3 settles at about 28 MB, AdGuard Home 0.107.79 at about 105 MB with its default settings. This was measured on a PC (x86-64 Linux, each program on 2 cores) so all three ran under the same conditions. A real router will show somewhat different numbers; Fengard 1.3.1.3 uses about 33 MB on a GL-MT3000 with these lists. dev/memcompare has the script to run it yourself.

Download fengard-<version>.zip from the latest release, unzip it, and run the installer:

Both open the same menu:

Fengard setup

  1  Install on my router        OpenWrt-based routers, including GL.iNet (recommended)
  2  Run on this computer        protects the whole network through DNS; this computer stays on
  3  Remove from my router
  4  Remove from this computer

Choose 1. The installer finds your router, asks for its root password (on most routers that's the admin page password), and does everything else. When it finishes it prints the dashboard address, usually http://fengard.lan. Open it and create the admin account.

If AdGuard Home is using DNS port 53, the installer asks whether to turn it off so Fengard can take over. Removing Fengard turns it back on.

Windows may warn about a downloaded file. Choose More info → Run anyway, or right-click the zip, open Properties and tick Unblock before unzipping.

Without a computer. A router with internet access can install straight from the latest release over SSH:

wget -O- https://github.com/masaleem-oss/Fengard/releases/latest/download/router-install.sh | sh

From the router's web page (LuCI). Every release has a package for each CPU type: fengard_<version>_<cpu>.ipk for OpenWrt up to 24.10 (and GL.iNet), .apk for OpenWrt 25.12 and later. The CPU names match the Supported routers table, for example arm64 for a GL-MT3000 or mipsle for an MT7621 router.

1. In LuCI open System → Software, choose Upload Package… and pick the .ipk.
2. It sets itself up in about a minute, the same way the installer does. Log out of LuCI and back in, then open Services → Fengard to see how it went, start or stop it, and open the dashboard.

On GL.iNet firmware, LuCI is under System → Advanced Settings in the GL admin panel. If you pick the package for the wrong CPU, it says so and leaves the router as it was.

OpenWrt 25.12 and later: the LuCI upload doesn't work. 25.12 moved to the apk package manager, which only installs packages signed by a key the router already trusts. LuCI's upload page has no way to allow anything else, and there's no way to add a trusted key from LuCI either, so it refuses every package that isn't from OpenWrt itself, Fengard included. Signing Fengard's packages wouldn't change that, because the router would still need Fengard's key put on it over SSH first. On 25.12 use the one-line install above, or install the .apk over SSH:

Copy it to the router (scp -O fengard_<version>_<cpu>.apk root@192.168.1.1:/tmp/), then run:

apk add --allow-untrusted /tmp/fengard_<version>_<cpu>.apk

The Services → Fengard page works the same after that.

Fengard needs OpenWrt-based firmware with SSH access.

If your router is in the right-hand column, use computer mode, or flash OpenWrt if your model supports it.

The installer checks memory and storage first and stops cleanly if the router is too small.

Every release is installed on 13 emulated routers, covering ARM64, ARMv7, MIPS, MIPS64 and x86 on OpenWrt 19.07 to 25.12, before it ships. See the router lab results for every router type, the checks each one passes and how much memory Fengard uses on it.

Power cuts mid-install, a full flash, too little memory, another DNS server on port 53, AdGuard Home, firmware upgrades, a crashing program and GL.iNet quirks are all tested too, and the house keeps DNS in every one of them. See When things go wrong.

It reads everything from the router's own configuration: an alias address for the dashboard, port 53 for DNS, a firewall include and the WireGuard interface. Every change is recorded and undone on uninstall. See what the installer changes.

For routers that can't run Fengard, option 2 runs it on an always-on computer as a background service:

It opens the local network through the computer's firewall (Windows Firewall, the macOS firewall, ufw or firewalld) and then tells you the one step left: set your router's DHCP DNS server to this computer.

Computer mode filters every device by DNS but has limits:

• No firewall. Port forwards, bypass blocking, flood limits and the VPN need the router install.
• The computer must stay on and awake. While it sleeps, devices lose name lookups.
• Its address must not change. Reserve it in the router's DHCP settings.
• Only one DNS server. Give devices no second DNS server, or they can go around Fengard.

• Router: option 3 in the menu, or sh /etc/fengard/uninstall.sh on the router. Add --purge to also delete settings and history. If you installed the package, removing fengard in System → Software (or opkg remove fengard, apk del fengard) does the same, keeping settings for a reinstall.
• Computer: option 4 in the menu. Then set your router's DHCP DNS server back to automatic.

_{The dashboard follows your GitHub theme: dark or light, same as the real one.}

Devices. Found automatically, with the manufacturer from the MAC address.	One device. Its activity, top sites, profile, pause and Wake-on-LAN.
Profiles. Categories, apps, SafeSearch, schedules and screen time per person.	Check a site. What every profile would do with a domain, and why.
Activity. Every lookup, live or historical, filtered by device or domain.	Filtering. Categories, block and allow rules, temporary allows and custom lists.
Firewall. Bypass blocking, quarantine and WAN hardening, with the live ruleset.	Alerts. New devices, access requests, limits and upstream problems.
Port forwarding. Open a port to one device, enforced in the kernel.	DNS. Plain, DoT, DoH or HTTP/3 upstreams, DNSSEC and .lan records.
Command palette. Ctrl K jumps to pages, devices or a site check.	Settings. Accounts, two-factor, notifications, API keys, backups and history.

What a device on the network sees:

Block page with the reason and a request-access form.

My time at fengard.lan/me: what's used, what's left, and a "need more time?" button.

On a laptop the same page, served over HTTP and HTTPS.

_{Screenshots are from a simulated home network with demo devices and a month of generated history.}

Devices keep using the router for DNS as they always did. Fengard answers those lookups, and its rules in the router's own nftables or iptables firewall make sure nothing gets around it: other DNS servers, DNS over HTTPS, TLS or QUIC, and Tor are redirected or blocked in the kernel. If Fengard stops, the router's dnsmasq takes DNS over and the house stays online. See how it works for the design, performance and security.

Command line flags, environment, files and the HTTP API are in the configuration reference.

Is Fengard a Pi-hole or AdGuard Home alternative? Yes. It blocks ads, trackers and malware for the whole network like they do, and adds per-person screen time, app blocking, a block page and firewall enforcement. See How it compares.

Can kids get around it with DNS-over-HTTPS, a VPN or a different DNS server? Changing DNS doesn't help: all lookups are redirected back to Fengard, and DoH, DoT, DoQ and Tor are blocked in the router's firewall. Known VPN and proxy services are blocked by the "VPN, proxy & DNS bypass" category. No filter catches every VPN, so for younger kids pair it with a schedule or a device pause.

What about phones with private (random) Wi-Fi addresses? Most phones keep one private address per network, so they stay the same device. When one does change (iOS "Rotating", forgetting the network), Fengard recognizes it from its DHCP name and fingerprint, the old address going quiet at the same moment, and the sites it uses, and puts it back in its own profile. Guesses it isn't sure about wait for you on the Devices page, and Same device as… links any two by hand. Two devices online at once are never merged, and copying a name isn't enough to get someone else's profile.

Does Fengard do DNS over HTTP/3? Yes. Turn on DNS → Use HTTP/3 and pick a DoH upstream (Cloudflare, Google, Quad9 and AdGuard all work). It's done by fengard-h3, a QUIC and HTTP/3 client written for Fengard that only does what DNS needs, so it adds about 0.1 to 0.3 MB to the program instead of the several MB a general purpose QUIC library would. The TLS 1.3 handshake comes from Go's standard library. With the switch off it uses no memory at all, and if UDP is blocked on the way Fengard goes back to HTTP/2 by itself and tries HTTP/3 again later. The DNS page shows which one each upstream is using.

Against quic-go's HTTP/3 client with its default settings, on the same server (dev/h3lab, go test -bench Vs):

fengard-h3 pings a connection that's been used in the last five minutes before the server would drop it, connects as soon as HTTP/3 is switched on, and resumes the TLS session when it does have to reconnect.

Do I have to flash my router? No. If it already runs OpenWrt or GL.iNet firmware, Fengard installs next to it and uninstalls cleanly. If it runs stock firmware that isn't OpenWrt-based, use computer mode or flash OpenWrt.

Does it work on GL.iNet routers? Yes. GL.iNet firmware is OpenWrt-based, and Fengard is used daily on a GL-MT3000 (Beryl AX). The installer handles GL.iNet's own web server and firewall setup.

How should I set up the router's DNS before installing? Leave it as it is. If AdGuard Home is on, the installer offers to turn it off, since Fengard does the filtering and AdGuard Home would only take up memory, and removing Fengard turns it back on. After that, pick your DNS servers on Fengard's DNS page. The router's own DNS settings no longer matter, and changing them later doesn't break anything.

Will it slow my internet down? No. Only DNS lookups go through Fengard, answered in milliseconds and mostly from cache. Everything else is plain kernel routing. It uses about 25 MB of memory.

Can it brick my router, or take the internet down? It doesn't touch the firmware or bootloader, so there's nothing to brick, and uninstall puts everything back. For the internet, the installer never moves DNS until Fengard is set to start at boot, and a watchdog hands DNS to the router's own dnsmasq if Fengard ever stops answering. Both are tested in the router lab, including a power cut mid-install and a firmware upgrade.

How do updates work? Fengard checks GitHub twice a day. When a new release is out, it reads the release's list of supported CPUs, the oldest OpenWrt it runs on and the memory it needs, and only offers it if this router qualifies. You get an alert and a banner with Update now. It downloads the update, checks its checksum, test-runs it on a private port and only then swaps it in. If the new version doesn't answer DNS, the old one comes back on its own. Turn on Settings → Install updates automatically to have this happen overnight, between 3 and 5 am.

Can I go back to an older version? Yes, from 1.3.1.2. Settings → Updates → Go back… lists older releases back to 1.3.0. Going back gets the same checks as an update, your settings are backed up first, and automatic updates then skip the version you left until something newer comes out.

What are preview builds? Pre-releases with a fourth number, like 1.3.1.1, that come out between full releases so new things can be tried early. They go through the same router lab and tests. Nobody gets one unless they turn on Settings → Updates → Preview builds (from 1.3.1), and a preview you're on is replaced by the next full release once that's out.

Is it free? Yes. Fengard is open source under the Apache 2.0 license, with no accounts, cloud or subscription. Everything stays on your router.

Building, testing, the router and network labs and how releases are made are in docs/development.md, with a project layout.

Router test reports are the most useful thing right now: if you try Fengard on a router, please tell us how it went. Bug reports and pull requests are welcome too, see CONTRIBUTING.md. What changed in each release is in CHANGELOG.md.

Fengard is licensed under the Apache License 2.0. Third-party components are listed in NOTICE: IBM Plex Sans and Mono (OFL), Lucide icons (ISC), Simple Icons logos (CC0), qrcode-generator (MIT) and the IEEE MA-L vendor registry (the manufacturer names add-on), all bundled so the dashboard works offline. Blocklists aren't distributed with Fengard; each installation downloads them from their publishers under the publishers' licenses.

What gets built next as the repo grows. Fixes and new router support keep coming either way.

_{Made by masaleem-oss}