What a Shield does, next to what you might already have.
Most questions we get are some version of “doesn't my iPhone, my modem or a Pi-hole already do this?” Sometimes, in part. The picture shows what only a Shield does; the map under it has the detail, row by row.
The 30-day home trial for AU & NZ households: if Shield isn't right for your home, send it back — prepaid label, full refund.
Yes yesMostly mostlyIn part in partA little a littleNo not what it's for
Open any row for the facts behind its circles.
| What a household filter is asked to do | WOMBATS ShieldOne box behind the modem | Screen TimeOn each child's Apple device | |||||
|---|---|---|---|---|---|---|---|
| On the phone itselfWhat only the device can see: screen hours, installs, purchases, who they message. | |||||||
| No | Yes | ||||||
WOMBATS ShieldNo The phone's own job. Keep Screen Time or Family Link running; a Shield sits beside them, not instead of them. Screen TimeYes Time Allowances, Screen Time Schedules, Ask to Buy, Ask to Browse, Allowed Contacts and Communication Safety, managed from a parent's iPhone through Family Sharing. Some modemsA little Only where the maker sells an app for the child's phone on its paid tier (TP-Link's KidShield, Netgear's My Time). Pi-holeNo Not what it's for. AdGuard HomeNo Not what it's for. FirewallaNo Not what it's for. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Website lookupsWhat loads: ads, trackers, adult sites, search results. The DNS layer. | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes On by default for every device that joins your network, with nothing to install. Screen TimeNo Not a Screen Time feature. Some modemsA little Only on eero's paid tier (eero Plus lists ad blocking). TP-Link's and Netgear's parental controls don't list it. Pi-holeYes Yes: a DNS sinkhole on hardware you supply. Subscribe to blocklists, then point your router's DHCP at it (or make Pi-hole the DHCP server) so every device uses it for DNS. AdGuard HomeYes Yes: a DNS server you run. Enable its filter lists, then set your router, or each device, to use it for DNS. FirewallaYes Yes: a built-in ad and tracker blocker, run locally on the box. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Yes | In part | ||||||
WOMBATS ShieldYes On by default, for every device, with a level per category from Off to Strict on your dashboard. Screen TimeIn part Limit Adult Websites and Ask to Browse, in Safari and supported browsers on that Apple device. Phishing isn't a Screen Time category. Some modemsIn part Where offered: a category filter through the maker's app (adult content, gambling and the like); malicious-site blocking is a paid security tier on TP-Link and eero. Pi-holeIn part Only with blocklists you find, add and keep updated yourself; its defaults don't include adult or phishing lists. AdGuard HomeYes Yes: the parental-control and safe-browsing toggles in Settings → General, which use AdGuard's web services. FirewallaYes Yes: Content Filter in Native Mode blocks porn, gambling, VPN sites and more on the box; Active Protect blocks malicious addresses at the IP layer. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes On every Shield for the whole house: Google, Bing, YouTube, DuckDuckGo, Ecosia, Yandex and Pixabay, each a tick on the dashboard. Screen TimeNo SafeSearch isn't among its settings. Some modemsA little A paid tier where offered: TP-Link's Advanced Parental Controls (Google results only), eero Plus. Netgear's page doesn't list it. Pi-holeNo Not a setting in its documentation. AdGuard HomeYes Yes: Enforce safe search in Settings → General, per engine, or per client. FirewallaYes Yes: Safe Search is one of its DNS services, per device, group or network. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes Out of the box, at home your Shield looks websites up from the internet's root servers itself (recursive DNS). Your internet provider still sees which sites you connect to. Screen TimeNo Not a Screen Time feature; the device uses whatever DNS the network gives it. Some modemsNo Lookups go to the provider's or the maker's DNS servers. Pi-holeA little Forwards to the upstream you choose at install (Google, Cloudflare and others). Its Unbound guide adds a separate recursive resolver you install, configure and keep updated. AdGuard HomeA little Forwards to upstreams you configure (plain, DNS-over-HTTPS, -TLS or -QUIC). No recursive resolver built in. FirewallaMostly As an option: Unbound, a validating recursive resolver on the box, which you switch on per device, group or network. Off by default, lookups go to the DNS servers you or your provider set. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| The firewallWhat a lookup-only filter can't reach: apps' backup routes, and the ways around a filter. | |||||||
| Yes | In part | ||||||
WOMBATS ShieldYes Main route and backup routes closed at the network, through website lookups and the Shield's own firewall. Facebook, Instagram, Messenger and Threads on their own switches, WhatsApp untouched. Re-tested every month. Screen TimeIn part Blocks the app on that Apple device (it dims on the Home Screen). Nothing at the network, so the TV, the console and Android devices are outside it. Some modemsA little App blocking by name is a paid tier where offered (TP-Link's Advanced Parental Controls, eero Plus), and it works from a list of addresses. Backup routes aren't mentioned by the makers we checked. Pi-holeA little Lookups only: an app is blocked as far as the domains on your lists go. Traffic that never asks for a name isn't seen. AdGuard HomeA little Blocked services are DNS rules from a public list. Its TikTok entry didn't include the backup route TikTok used in our test (27 September 2026). FirewallaIn part Blocks apps and categories (games, video, social) with rules at the DNS and IP layer, per device or group. Whether an app's backup routes are covered isn't stated on the pages we read. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes Shut at the network, and attempts show on your dashboard. The rules live on the Shield, behind its own login, not on the phone. A determined user on a managed device can still use a VPN to tunnel out. Screen TimeNo The rules live on the device, so the workarounds kids pass around (a time-zone change, deleting and reinstalling an app) live there too. Apple closes them as they surface; a child account on recent iOS locks the date and time. Some modemsNo The rules live in the modem: its reset button restores factory settings, and the admin password is often on the sticker. Encrypted DNS and Private Relay aren't mentioned by the makers we checked. Pi-holeA little Switches off Firefox's encrypted-DNS canary and iCloud Private Relay by default. Stopping a device from using its own DNS server or a DoH app needs firewall rules you write on your router. AdGuard HomeNo Not covered in the pages we checked. Stopping a device from using its own DNS server needs firewall rules you write on your router. FirewallaMostly DNS Booster intercepts a device's own DNS settings by default; blocking encrypted DNS and Private Relay are extra steps its help centre documents. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Rules a parent runs from their phonePause, bedtime and school-night hours, and different rules for each child. | |||||||
| Yes | In part | ||||||
WOMBATS ShieldYes Every Shield: pause one device's internet, or set its bedtime and school-night hours, from your phone. The device itself keeps working offline, so a homework document does too. Screen TimeIn part Screen Time Schedules and a pause, for each child's Apple device. They lock the device or the app rather than the internet, so homework on it stops too. Other devices aren't covered. Some modemsMostly Where offered, pause and bedtime per profile are usually on the free tier, through the maker's app and cloud. Pi-holeNo No pause or schedule setting for a device in its documentation. AdGuard HomeA little A weekly schedule for blocked services, per client, in the config file or the client settings. No internet-pause setting for a device. FirewallaYes Yes: pause, schedules and time limits per device, group or network, in its app. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Yes | Yes | ||||||
WOMBATS ShieldYes Shield Edge and Vault: filtering, SafeSearch and app rules per device, app schedules included. Shield Core sets them for the whole house at once; pause and schedules are per device on every Shield. Screen TimeYes Per child, on their Apple devices, from a parent's iPhone through Family Sharing. Some modemsMostly Where offered, per profile, through the maker's app. Pi-holeIn part Group management: assign each client by IP or MAC address to a group in the web interface, then attach lists and regex rules to the group. AdGuard HomeMostly Per-client settings keyed by IP, CIDR range, MAC address (only when it is your DHCP server) or a ClientID; $client and $ctag modifiers in custom filtering rules. FirewallaYes Yes: rules per device, device group or network, with group settings taking precedence. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Away from homeThe kids' phones on mobile data and on other people's Wi-Fi. | |||||||
| Yes | Yes | ||||||
WOMBATS ShieldYes Shield Vault, through Follow-Me Filtering: your rules on the kids' phones away from home, through a free app. The phone's owner can switch it off, and it depends on your home internet. Screen TimeYes Everywhere the device goes: the rules live on it. Some modemsA little Only with the maker's app on the child's phone, on its paid tier (TP-Link's KidShield, Netgear's My Time). Pi-holeA little Do it yourself: install a WireGuard VPN server beside Pi-hole (its docs have a guide), open a port on your router, generate keys for each phone and set up the app on it. AdGuard HomeA little Do it yourself: a public hostname with a TLS certificate, DNS-over-HTTPS or -TLS enabled, a port opened on your router, and the phone's private-DNS setting pointed at it. FirewallaMostly Its built-in VPN server (OpenVPN or WireGuard, no monthly fee) brings phones back through your home network; you set up the VPN app on each phone. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Every device, and who keeps it runningCoverage, setup, upkeep, and what you own. | |||||||
| Yes | A little | ||||||
WOMBATS ShieldYes Plug it in behind the modem. Every device that joins is covered: computers, phones, tablets, TVs, consoles and smart devices, with nothing to install. Screen TimeA little The Apple devices in your Family Sharing group. Android, Windows, the TV and the console aren't covered. Some modemsYes Everything on the home Wi-Fi. Pi-holeMostly Every device, once your router hands out Pi-hole as the DNS server (DHCP option 6) or Pi-hole runs the DHCP itself; a device set to its own DNS steps around it. AdGuard HomeMostly Every device, once your router hands it out as the DNS server or it runs the DHCP itself; a device set to its own DNS steps around it. FirewallaYes Yes: it is the firewall or router for the whole network. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Yes | Mostly | ||||||
WOMBATS ShieldYes About fifteen minutes with your modem's admin login: Modem Autopilot sets up the modems in most Australian homes, and Guided Setup walks you through any it can't. With Starlink, eero and other routers you can only set up in a phone app, talk to us before ordering. Screen TimeMostly Family Sharing, a Child Account for each child, and every device in the group on the current software; the settings then live under Family in the parent's Settings app. Some modemsYes Where offered, it's in the app you already use for the Wi-Fi: a profile per child, devices assigned to it. Pi-holeA little Install a supported Linux on a Pi or a container, run the installer script, then change your router's DHCP DNS setting (or move DHCP to Pi-hole). AdGuard HomeA little Install with the script, Docker or Snap, finish setup in its web interface, then change your router's DNS setting or each device's. FirewallaIn part Set up and managed in the Firewalla app; choosing router, bridge or simple mode for your network is yours to get right. SynologyIn part Choose the drives, create storage with the RAID type you pick, then set up DSM and the packages you want. | |||||||
| Yes | Yes | ||||||
WOMBATS ShieldYes Signed updates you install in under a minute, WhatsApp and email support, a 12-month warranty plus Australian Consumer Law, and a 30-day home trial for AU & NZ households. Screen TimeYes Updates with the device; Apple Support behind it. Some modemsMostly The maker's updates and support; the parental-control tier renews as a subscription where it's paid. Pi-holeA little You run its updates (pihole -up) and the operating system's, keep the lists current and troubleshoot; help is its community forum; its licence disclaims warranty. AdGuard HomeA little You update it from the web interface's button or by swapping the binary, and troubleshoot; help is its GitHub issues and community; no warranty. FirewallaMostly Updates through its app; a help centre, forum and community; a warranty under its refund and warranty policy, with an extended warranty sold separately. SynologyMostly DSM updates, a knowledge centre and community, and Synology's warranty; the upkeep is yours. | |||||||
| Yes | In part | ||||||
WOMBATS ShieldYes The dashboard runs on the Shield, on your network. No cloud login, no activation server, no subscription: if we disappear, your Shield keeps working. Screen TimeIn part No subscription. It needs an Apple Account for each child and a Family Sharing group, and the settings sync through iCloud. Some modemsIn part Basic controls are free; the app usually needs an account with the maker, and app blocking, SafeSearch and the child-phone app renew as a subscription run through the maker's cloud. Pi-holeYes Yes: on your own hardware, no account. AdGuard HomeYes Yes: on your own machine, no account. FirewallaMostly No monthly fee for standard features. The app pairs with your box through Firewalla's cloud, and the optional MSP portal is a subscription. SynologyMostly Runs on your own NAS with no subscription for the basics; a Synology Account is used for remote access (QuickConnect) and some services. | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes Your own always-allow and always-block lists, three filter categories each set from Off to Strict, and who answers your lookups: the Shield itself, or a provider you name. The filter lists themselves are ours to keep. Screen TimeNo Not what it's for. Some modemsA little Blocking specific websites through the maker's app (TP-Link lists it in its free tier). Filter levels and who answers lookups aren't among the features the makers list. Pi-holeYes Allow and deny lists, regex rules, any blocklist URL you subscribe to, your choice of upstream servers, a query log and a command line. AdGuard HomeYes Filter lists, custom rules in adblock syntax, upstream servers per client, encrypted upstreams, and a query log. FirewallaYes Rules on domains, IPs and categories, custom DNS rules, your choice of DNS service, and full flow logs. SynologyNo Not what a NAS does. Synology sells Wi-Fi routers separately, with parental controls. | |||||||
| Beyond filteringWhat else the same box does for the house. | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes Shield Edge, on a USB drive you supply, and Shield Vault, with a 256 GB drive built in (1, 2 or 4 TB optional): photos, videos and files shared across the household (SMB). Screen TimeNo Not what it's for. Some modemsNo Not what it's for. Pi-holeNo Not what it's for. AdGuard HomeNo Not what it's for. FirewallaNo Not what it's for. SynologyYes Yes: what it is for. File storage shared across the house, with the RAID type and volumes you choose. | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes Shield Edge and Vault: a media library your TVs can play (Jellyfin, DLNA), with no account anywhere. Screen TimeNo Not what it's for. Some modemsNo Not what it's for. Pi-holeNo Not what it's for. AdGuard HomeNo Not what it's for. FirewallaNo Not what it's for. SynologyYes Yes: its Media Server package streams to devices on your network (DLNA). | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes Shield Vault: a backup drive for any computer in the house, with Time Machine support for Macs, on a built-in drive that can be encrypted (switched on when you first set up the drive). Screen TimeNo Not what it's for. Some modemsNo Not what it's for. Pi-holeNo Not what it's for. AdGuard HomeNo Not what it's for. FirewallaNo Not what it's for. SynologyYes Yes: Time Machine for Macs (over SMB or AFP) and backups for other computers, set up by you. | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes Shield Edge over a cable into the accommodation's router; Shield Vault cable-free, joining the hotel or Airbnb Wi-Fi, even networks with a login page. Screen TimeNo Not what it's for. Some modemsNo Not what it's for. Pi-holeNo Not what it's for. AdGuard HomeNo Not what it's for. FirewallaMostly Purple SE and Orange are made to take with you, to secure public Wi-Fi with your own protected network. SynologyNo Not offered on a NAS. | |||||||
| Yes | No | ||||||
WOMBATS ShieldYes Shield Vault, through Back to Shield: the same free app puts your phone or laptop back on your home network, at your home internet's upload speed. Screen TimeNo Not what it's for. Some modemsIn part The maker's app manages the modem from anywhere through the maker's cloud; files aren't part of it. Pi-holeA little Do it yourself, over the WireGuard server you set up for the phones. AdGuard HomeNo Not what it's for. FirewallaIn part The app reaches your box from anywhere through Firewalla's cloud; files aren't part of it. SynologyMostly Remote access to the NAS and its files is part of DSM (QuickConnect, with a Synology Account), set up by you. | |||||||
| The full comparison, one page each | Three Shields | Shield vs Screen Time | |||||
What it adds up to.
Apple's controls complement a Shield.
Screen Time does the on-device job: hours, installs, purchases, who they message. A Shield does the network job: every device at once, ads and trackers, the apps that fight back. Keep both.
Pi-hole and AdGuard Home are for people who'll run a server.
They do the lookups layer well. You install them, point your router at them, keep them updated and troubleshoot them; help is a forum or GitHub issues, and there's no warranty or trial. A Shield has that engine inside, already tuned, with someone to message.
Some modems list parental controls; read what the list is.
Usually a pause and a bedtime per profile, a category filter, and app blocking by address list on a paid tier. Backup routes aren't mentioned by the makers we checked, and a modem from your internet provider may have less, or none.
Rules on the device, or in the modem, get worked around there.
Kids pass around time-zone tricks and app reinstalls for Screen Time; a modem has a reset button and a password on a sticker. A Shield's rules live on the network, behind its own login, and the common ways around a filter are shut there. A determined user on a managed device can still use a VPN to tunnel out.
The full comparisons, one page each.
Founding Edition
Protection from $424 AUD, inc GST (Shield Core) · storage and media from $524 (Shield Edge, with your own USB drive) · Shield Vault $724
Founding prices for the first 20 numbered Shields, locked in for life. Standard prices from unit 21: Core $574 · Edge $664 · Vault $914, plus $25 delivery in Australia.
Pay in 4: From $106.00 a fortnight with Afterpay or PayPal, interest-free — or Zip, with weekly, fortnightly or monthly repayments on Zip's terms. The total is the same either way.
30-day home trial for households in Australia and New Zealand · 12-month warranty plus Australian Consumer Law · Security updates until at least 31 December 2029
This comparison is based on publicly available information from each maker’s own website and documentation, reviewed 30 September 2026. Apple, Screen Time, Family Link, TP-Link, HomeShield, Netgear, eero, Pi-hole, AdGuard, AdGuard Home, Firewalla, Synology, DSM are trademarks of their respective owners; WOMBATS Shield has no affiliation with, and no endorsement from, the companies or projects mentioned. Spot something outdated or unfair? Email hello@wombatss.com and we’ll fix it.