Compare

WOMBATS Shield vs AdGuard Home: the engine, and the car around it.

AdGuard Home is free, open-source software that blocks ads and tracking across a whole network by answering website lookups, run on your own machine. It is excellent. It is also the filtering engine inside every Shield, hardened and with several defaults changed, and we say so on our security page. So this isn't one against the other. It is what the engine does on its own, next to what the box around it adds.

The 30-day home trial for AU & NZ households: if Shield isn't right for your home, send it back — prepaid label, full refund.

Choose a Shield if…

…you want the engine already tuned, plus the parts that aren't DNS: a firewall layer that closes apps' backup routes, the common ways around a filter shut at the network, pause and schedules per device from your phone, Modem Autopilot for the setup, signed updates, Follow-Me Filtering on Shield Vault, family storage and travel Wi-Fi on Edge and Vault, and someone to message.

Choose AdGuard Home if…

…you enjoy running your own server. It's free, it's open source, per-client settings, safe search and parental control are built in, and you're happy to install it, point your devices at it and keep it updated. A great project, well worth supporting.

Website lookups are one layer. The rest of the job is the other layers.

A DNS filter answers the lookups sent to it, and that is most of ad and tracker blocking, which is why we chose AdGuard Home. What it doesn't see: an app reaching a server without asking for its name, a device sent to a different DNS server, or the traffic itself, so pausing a device's internet isn't a DNS setting. Those are firewall jobs, and a Shield's firewall does them on the same box, with the modem set up for you and the whole thing kept up by us.

Side by side.

See it as a map, next to the others

What it is

WOMBATS Shield: A supported hardware appliance for the whole family job, bought once, with AdGuard Home as its filtering engine.
AdGuard Home: Free, open-source software (GPL-3.0): a network-wide ad and tracker blocking DNS server you run on your own machine, a Raspberry Pi or a supported router.

Setup

WOMBATS Shield: About fifteen minutes with your modem's admin login. It works with the modems in most Australian homes, and Guided Setup walks you through any it can't set up by itself; with Starlink, eero and other routers you can only set up in a phone app, talk to us before ordering.
AdGuard Home: Install it (a one-line script, Docker or the Snap Store), open its web interface, then point your router or each device at it for DNS.

Who does the upkeep

WOMBATS Shield: We do: the public filter lists keep updating on their own, we publish signed software updates you install from your Shield's Update page in under a minute, and we answer support.
AdGuard Home: You do: updates from its release page or its update button, filters, troubleshooting, with help from its GitHub issues and community.

Screen hours, app installs, purchases and who they can message

WOMBATS Shield: No. The phone's own job. Keep Screen Time or Family Link running; a Shield sits beside them, not instead of them.
AdGuard Home: No. Not what it's for.

Ads and trackers blocked on every device, TVs and smart devices included

WOMBATS Shield: Yes. On by default for every device that joins your network, with nothing to install.
AdGuard Home: Yes. Yes: a DNS server you run. Enable its filter lists, then set your router, or each device, to use it for DNS.

Adult content and phishing blocked

WOMBATS Shield: Yes. On by default, for every device, with a level per category from Off to Strict on your dashboard.
AdGuard Home: Yes. Yes: the parental-control and safe-browsing toggles in Settings → General, which use AdGuard's web services.

SafeSearch enforced on Google, Bing and YouTube

WOMBATS Shield: Yes. On every Shield for the whole house: Google, Bing, YouTube, DuckDuckGo, Ecosia, Yandex and Pixabay, each a tick on the dashboard.
AdGuard Home: Yes. Yes: Enforce safe search in Settings → General, per engine, or per client.

Recursive DNS built in: your Shield looks websites up itself, so no DNS company sees what the house looks up

WOMBATS Shield: Yes. Out of the box, at home your Shield looks websites up from the internet's root servers itself (recursive DNS). Your internet provider still sees which sites you connect to.
AdGuard Home: A little. Forwards to upstreams you configure (plain, DNS-over-HTTPS, -TLS or -QUIC). No recursive resolver built in.

TikTok off means off: apps built to stay online (TikTok, Meta's apps) closed on their backup routes too

WOMBATS Shield: Yes. Main route and backup routes closed at the network, through website lookups and the Shield's own firewall. Facebook, Instagram, Messenger and Threads on their own switches, WhatsApp untouched. Re-tested every month.
AdGuard Home: A little. Blocked services are DNS rules from a public list. Its TikTok entry didn't include the backup route TikTok used in our test (27 September 2026).

Bypass tricks blocked: a device's own DNS settings, encrypted-DNS apps, Apple Private Relay, a reset

WOMBATS Shield: Yes. Shut at the network, and attempts show on your dashboard. The rules live on the Shield, behind its own login, not on the phone. A determined user on a managed device can still use a VPN to tunnel out.
AdGuard Home: No. Not covered in the pages we checked. Stopping a device from using its own DNS server needs firewall rules you write on your router.

Pause the internet, bedtime and school-night hours, per device: phones, TVs, consoles, everything

WOMBATS Shield: Yes. Every Shield: pause one device's internet, or set its bedtime and school-night hours, from your phone. The device itself keeps working offline, so a homework document does too.
AdGuard Home: A little. A weekly schedule for blocked services, per client, in the config file or the client settings. No internet-pause setting for a device.

Different rules for each child's device

WOMBATS Shield: Yes. Shield Edge and Vault: filtering, SafeSearch and app rules per device, app schedules included. Shield Core sets them for the whole house at once; pause and schedules are per device on every Shield.
AdGuard Home: Mostly. Per-client settings keyed by IP, CIDR range, MAC address (only when it is your DHCP server) or a ClientID; $client and $ctag modifiers in custom filtering rules.

The same rules on the kids' phones on mobile data and other Wi-Fi

WOMBATS Shield: Yes. Shield Vault, through Follow-Me Filtering: your rules on the kids' phones away from home, through a free app. The phone's owner can switch it off, and it depends on your home internet.
AdGuard Home: A little. Do it yourself: a public hostname with a TLS certificate, DNS-over-HTTPS or -TLS enabled, a port opened on your router, and the phone's private-DNS setting pointed at it.

Every device covered, nothing installed on any of them

WOMBATS Shield: Yes. Plug it in behind the modem. Every device that joins is covered: computers, phones, tablets, TVs, consoles and smart devices, with nothing to install.
AdGuard Home: Mostly. Every device, once your router hands it out as the DNS server or it runs the DHCP itself; a device set to its own DNS steps around it.

Set up in about fifteen minutes, with no technical skill

WOMBATS Shield: Yes. About fifteen minutes with your modem's admin login: Modem Autopilot sets up the modems in most Australian homes, and Guided Setup walks you through any it can't. With Starlink, eero and other routers you can only set up in a phone app, talk to us before ordering.
AdGuard Home: A little. Install with the script, Docker or Snap, finish setup in its web interface, then change your router's DNS setting or each device's.

Kept up for you: updates, someone to message, a warranty, a home trial

WOMBATS Shield: Yes. Signed updates you install in under a minute, WhatsApp and email support, a 12-month warranty plus Australian Consumer Law, and a 30-day home trial for AU & NZ households.
AdGuard Home: A little. You update it from the web interface's button or by swapping the binary, and troubleshoot; help is its GitHub issues and community; no warranty.

Local first: no cloud, no account, no subscription

WOMBATS Shield: Yes. The dashboard runs on the Shield, on your network. No cloud login, no activation server, no subscription: if we disappear, your Shield keeps working.
AdGuard Home: Yes. Yes: on your own machine, no account.

Your own allow and block lists, filter levels, and who answers your lookups

WOMBATS Shield: Yes. Your own always-allow and always-block lists, three filter categories each set from Off to Strict, and who answers your lookups: the Shield itself, or a provider you name. The filter lists themselves are ours to keep.
AdGuard Home: Yes. Filter lists, custom rules in adblock syntax, upstream servers per client, encrypted upstreams, and a query log.

Family file storage every device in the house can open

WOMBATS Shield: Yes. Shield Edge, on a USB drive you supply, and Shield Vault, with a 256 GB drive built in (1, 2 or 4 TB optional): photos, videos and files shared across the household (SMB).
AdGuard Home: No. Not what it's for.

Movies, music and photos streamed to your TVs, even older ones

WOMBATS Shield: Yes. Shield Edge and Vault: a media library your TVs can play (Jellyfin, DLNA), with no account anywhere.
AdGuard Home: No. Not what it's for.

Computer backups, with Time Machine for Macs

WOMBATS Shield: Yes. Shield Vault: a backup drive for any computer in the house, with Time Machine support for Macs, on a built-in drive that can be encrypted (switched on when you first set up the drive).
AdGuard Home: No. Not what it's for.

Your own filtered Wi-Fi in a hotel or an Airbnb

WOMBATS Shield: Yes. Shield Edge over a cable into the accommodation's router; Shield Vault cable-free, joining the hotel or Airbnb Wi-Fi, even networks with a login page.
AdGuard Home: No. Not what it's for.

Your dashboard and the family's files from a phone or laptop away from home

WOMBATS Shield: Yes. Shield Vault, through Back to Shield: the same free app puts your phone or laptop back on your home network, at your home internet's upload speed.
AdGuard Home: No. Not what it's for.

Feature	WOMBATS Shield	AdGuard Home
What it is	A supported hardware appliance for the whole family job, bought once, with AdGuard Home as its filtering engine.	Free, open-source software (GPL-3.0): a network-wide ad and tracker blocking DNS server you run on your own machine, a Raspberry Pi or a supported router.
Setup	About fifteen minutes with your modem's admin login. It works with the modems in most Australian homes, and Guided Setup walks you through any it can't set up by itself; with Starlink, eero and other routers you can only set up in a phone app, talk to us before ordering.	Install it (a one-line script, Docker or the Snap Store), open its web interface, then point your router or each device at it for DNS.
Who does the upkeep	We do: the public filter lists keep updating on their own, we publish signed software updates you install from your Shield's Update page in under a minute, and we answer support.	You do: updates from its release page or its update button, filters, troubleshooting, with help from its GitHub issues and community.
Screen hours, app installs, purchases and who they can message	No. The phone's own job. Keep Screen Time or Family Link running; a Shield sits beside them, not instead of them.	No. Not what it's for.
Ads and trackers blocked on every device, TVs and smart devices included	Yes. On by default for every device that joins your network, with nothing to install.	Yes. Yes: a DNS server you run. Enable its filter lists, then set your router, or each device, to use it for DNS.
Adult content and phishing blocked	Yes. On by default, for every device, with a level per category from Off to Strict on your dashboard.	Yes. Yes: the parental-control and safe-browsing toggles in Settings → General, which use AdGuard's web services.
SafeSearch enforced on Google, Bing and YouTube	Yes. On every Shield for the whole house: Google, Bing, YouTube, DuckDuckGo, Ecosia, Yandex and Pixabay, each a tick on the dashboard.	Yes. Yes: Enforce safe search in Settings → General, per engine, or per client.
Recursive DNS built in: your Shield looks websites up itself, so no DNS company sees what the house looks up	Yes. Out of the box, at home your Shield looks websites up from the internet's root servers itself (recursive DNS). Your internet provider still sees which sites you connect to.	A little. Forwards to upstreams you configure (plain, DNS-over-HTTPS, -TLS or -QUIC). No recursive resolver built in.
TikTok off means off: apps built to stay online (TikTok, Meta's apps) closed on their backup routes too	Yes. Main route and backup routes closed at the network, through website lookups and the Shield's own firewall. Facebook, Instagram, Messenger and Threads on their own switches, WhatsApp untouched. Re-tested every month.	A little. Blocked services are DNS rules from a public list. Its TikTok entry didn't include the backup route TikTok used in our test (27 September 2026).
Bypass tricks blocked: a device's own DNS settings, encrypted-DNS apps, Apple Private Relay, a reset	Yes. Shut at the network, and attempts show on your dashboard. The rules live on the Shield, behind its own login, not on the phone. A determined user on a managed device can still use a VPN to tunnel out.	No. Not covered in the pages we checked. Stopping a device from using its own DNS server needs firewall rules you write on your router.
Pause the internet, bedtime and school-night hours, per device: phones, TVs, consoles, everything	Yes. Every Shield: pause one device's internet, or set its bedtime and school-night hours, from your phone. The device itself keeps working offline, so a homework document does too.	A little. A weekly schedule for blocked services, per client, in the config file or the client settings. No internet-pause setting for a device.
Different rules for each child's device	Yes. Shield Edge and Vault: filtering, SafeSearch and app rules per device, app schedules included. Shield Core sets them for the whole house at once; pause and schedules are per device on every Shield.	Mostly. Per-client settings keyed by IP, CIDR range, MAC address (only when it is your DHCP server) or a ClientID; $client and $ctag modifiers in custom filtering rules.
The same rules on the kids' phones on mobile data and other Wi-Fi	Yes. Shield Vault, through Follow-Me Filtering: your rules on the kids' phones away from home, through a free app. The phone's owner can switch it off, and it depends on your home internet.	A little. Do it yourself: a public hostname with a TLS certificate, DNS-over-HTTPS or -TLS enabled, a port opened on your router, and the phone's private-DNS setting pointed at it.
Every device covered, nothing installed on any of them	Yes. Plug it in behind the modem. Every device that joins is covered: computers, phones, tablets, TVs, consoles and smart devices, with nothing to install.	Mostly. Every device, once your router hands it out as the DNS server or it runs the DHCP itself; a device set to its own DNS steps around it.
Set up in about fifteen minutes, with no technical skill	Yes. About fifteen minutes with your modem's admin login: Modem Autopilot sets up the modems in most Australian homes, and Guided Setup walks you through any it can't. With Starlink, eero and other routers you can only set up in a phone app, talk to us before ordering.	A little. Install with the script, Docker or Snap, finish setup in its web interface, then change your router's DNS setting or each device's.
Kept up for you: updates, someone to message, a warranty, a home trial	Yes. Signed updates you install in under a minute, WhatsApp and email support, a 12-month warranty plus Australian Consumer Law, and a 30-day home trial for AU & NZ households.	A little. You update it from the web interface's button or by swapping the binary, and troubleshoot; help is its GitHub issues and community; no warranty.
Local first: no cloud, no account, no subscription	Yes. The dashboard runs on the Shield, on your network. No cloud login, no activation server, no subscription: if we disappear, your Shield keeps working.	Yes. Yes: on your own machine, no account.
Your own allow and block lists, filter levels, and who answers your lookups	Yes. Your own always-allow and always-block lists, three filter categories each set from Off to Strict, and who answers your lookups: the Shield itself, or a provider you name. The filter lists themselves are ours to keep.	Yes. Filter lists, custom rules in adblock syntax, upstream servers per client, encrypted upstreams, and a query log.
Family file storage every device in the house can open	Yes. Shield Edge, on a USB drive you supply, and Shield Vault, with a 256 GB drive built in (1, 2 or 4 TB optional): photos, videos and files shared across the household (SMB).	No. Not what it's for.
Movies, music and photos streamed to your TVs, even older ones	Yes. Shield Edge and Vault: a media library your TVs can play (Jellyfin, DLNA), with no account anywhere.	No. Not what it's for.
Computer backups, with Time Machine for Macs	Yes. Shield Vault: a backup drive for any computer in the house, with Time Machine support for Macs, on a built-in drive that can be encrypted (switched on when you first set up the drive).	No. Not what it's for.
Your own filtered Wi-Fi in a hotel or an Airbnb	Yes. Shield Edge over a cable into the accommodation's router; Shield Vault cable-free, joining the hotel or Airbnb Wi-Fi, even networks with a login page.	No. Not what it's for.
Your dashboard and the family's files from a phone or laptop away from home	Yes. Shield Vault, through Back to Shield: the same free app puts your phone or laptop back on your home network, at your home internet's upload speed.	No. Not what it's for.

AdGuard Home and a Shield: where they overlap, and where they don't.

AdGuard Home is the lookups engine inside every Shield; what sits only in the green circle is the box around the engine. Row by row from the map: what only AdGuard Home does, what both do, and what only a Shield does.

Only AdGuard Home 0

Nothing in this map.

Both 13

Ads and trackersYes: a DNS server you run.
Adult content and phishingYes: the parental-control and safe-browsing toggles in Settings → General, which use AdGuard's web services.
SafeSearchYes: Enforce safe search in Settings → General, per engine, or per client.
Recursive DNS built inin partForwards to upstreams you configure (plain, DNS-over-HTTPS, -TLS or -QUIC).
TikTok off means offin partBlocked services are DNS rules from a public list.
Pause and bedtime per devicein partA weekly schedule for blocked services, per client, in the config file or the client settings.
Rules per childin partPer-client settings keyed by IP, CIDR range, MAC address (only when it is your DHCP server) or a ClientID; $client and $ctag modifiers in custom filtering rules.
Kids' phones away from homein partDo it yourself: a public hostname with a TLS certificate, DNS-over-HTTPS or -TLS enabled, a port opened on your router, and the phone's private-DNS setting pointed at it.
Every device, nothing installedin partEvery device, once your router hands it out as the DNS server or it runs the DHCP itself; a device set to its own DNS steps around it.
Set up without skillin partInstall with the script, Docker or Snap, finish setup in its web interface, then change your router's DNS setting or each device's.
Updates, support, warrantyin partYou update it from the web interface's button or by swapping the binary, and troubleshoot; help is its GitHub issues and community; no warranty.
No cloud, no account, no subscriptionYes: on your own machine, no account.
Your own lists and settingsFilter lists, custom rules in adblock syntax, upstream servers per client, encrypted upstreams, and a query log.

“In part” means AdGuard Home covers some of it: fewer devices, a paid tier, an app on the child's phone, or a server you run.

Only a Shield 6

Bypass tricks blockedShut at the network, and attempts show on your dashboard.
Family storageShield Edge, on a USB drive you supply, and Shield Vault, with a 256 GB drive built in (1, 2 or 4 TB optional): photos, videos and files shared across the household (SMB).
Media to the TVShield Edge and Vault: a media library your TVs can play (Jellyfin, DLNA), with no account anywhere.
Computer backupsShield Vault: a backup drive for any computer in the house, with Time Machine support for Macs, on a built-in drive that can be encrypted (switched on when you first set up the drive).
Travel Wi-FiShield Edge over a cable into the accommodation's router; Shield Vault cable-free, joining the hotel or Airbnb Wi-Fi, even networks with a login page.
Dashboard and files from awayShield Vault, through Back to Shield: the same free app puts your phone or laptop back on your home network, at your home internet's upload speed.

Founding Edition

Protection from $424 AUD, inc GST (Shield Core) · storage and media from $524 (Shield Edge, with your own USB drive) · Shield Vault $724

Founding prices for the first 20 numbered Shields, locked in for life. Standard prices from unit 21: Core $574 · Edge $664 · Vault $914, plus $25 delivery in Australia.

Pay in 4: From $106.00 a fortnight with Afterpay or PayPal, interest-free — or Zip, with weekly, fortnightly or monthly repayments on Zip's terms. The total is the same either way.

30-day home trial for households in Australia and New Zealand · 12-month warranty plus Australian Consumer Law · Security updates until at least 31 December 2029

Order a Shield Talk to us on WhatsApp

Compare all three models →What owners say →

Common questions.

Isn't a Shield just AdGuard Home in a box?

AdGuard Home is the filtering engine inside every Shield, hardened and with several defaults changed, and we say so on our security page. What a Shield adds is everything around the engine: a firewall layer that closes apps' backup routes, the common ways around a filter shut at the network, pause and schedules per device from your phone, Modem Autopilot for the setup, signed updates, Follow-Me Filtering on Shield Vault, family storage and travel Wi-Fi on Edge and Vault, and a company to message.

Why AdGuard Home inside the Shield, rather than Pi-hole?

Because of what it has built in on day one: enforced safe search, a parental-control filter for adult sites, phishing and malware lists, encrypted upstreams and per-client settings, all of which its own README lists. Those are the family features a Shield needed from the start. Pi-hole is an excellent project too, and it has its own page here.

I already run AdGuard Home. What changes if I switch?

A Shield takes over the job at the network, so nothing else needs to point at it: the modem hands the network to the Shield, and every device that joins is covered. You keep the engine you know, already tuned, and gain the layers a DNS server doesn't have: the firewall that closes apps' backup routes, bypass routes shut, per-device pause and schedules, and updates and support you don't have to do yourself.

This comparison is based on publicly available information from each maker’s own website and documentation, reviewed 30 September 2026. AdGuard, AdGuard Home are trademarks of their respective owners; WOMBATS Shield has no affiliation with, and no endorsement from, the companies or projects mentioned. Spot something outdated or unfair? Email hello@wombatss.com and we’ll fix it.