The questions buyers actually ask.

No. Shield connects behind your existing modem or router over Ethernet. Your Wi-Fi stays the same. Setup typically takes about 15 minutes from a browser on your home network.

Around 15 minutes for most homes. You plug Shield in, open the local setup page, choose your modem from the catalog, and confirm. We pre-fill the right network settings for the most common Australian modems so you don't have to think about DHCP or DNS.

Shield is designed to fit behind any standard router. We've tested it with Telstra, NBN Co, Optus and major retail modems. Mesh Wi-Fi, double-NAT and ISP-locked routers are all supported. If your network setup is unusual, talk to us before ordering.

Ads and ad networks. Trackers and profiling domains. Phishing and malware domains. Adult and unsafe content categories. SafeSearch enforcement on Google, Bing, YouTube, DuckDuckGo and the other supported search engines. Catalog-based blocking for supported apps and services.

Yes, for the adult-content categories Shield supports, with SafeSearch enforced on the major search engines (Google, Bing, YouTube, DuckDuckGo and others). As with any DNS-based filter, the result depends on the categories you enable and the devices you manage.

Yes, for the ad and tracking domains in the active filter sources. Some ads served from the same domains as the content itself can't be filtered cleanly at the DNS layer, that's a trade-off any DNS filter shares.

Shield blocks known harmful domains at the DNS layer before connections are made. It is one calm layer of defence, best paired with safe browsing habits, current device updates, and endpoint security where appropriate.

Shield blocks common encrypted-DNS bypass paths and Apple Private Relay traffic at the network level. A determined user on a managed device can still use a VPN to tunnel out. What you have is visibility, Shield will show you the device.

Yes. Per-device pause, filter relaxation, and category exclusion are all available from the local dashboard.

On your network. The dashboard runs on the Shield itself, and so does every filtering decision. There is no vendor cloud control plane sitting between you and the device, and that is the only honest answer to this question I would accept from a product I bought.

, Khalid, Founder, WOMBATS Shield

No. Shield does not maintain a browsing-history report or behavioural profiling dashboard. AdGuard Home defaults that would have produced these have been disabled or restricted in our build.

No telemetry. No query logs. No browsing history. Software updates land as signed bundles that the device verifies before applying, that is the only relationship Shield has with us by design. I built it that way because I would not put a device on my own network that had any other relationship with its vendor.

, Khalid, Founder, WOMBATS Shield

Filter list updates, software bundle updates, upstream DNS resolution, and any support workflow you initiate. Nothing about your day-to-day filtering or device management depends on us being online.

Your Shield keeps working. There is no required activation server, no cloud login, and no subscription that can lapse. The filter lists are public and continue updating without us. If WOMBATS ceased to exist tomorrow, the device would keep doing its job, because it works locally, on hardware you own, with rules you can inspect. Most products in this category cannot make that claim.

, Khalid, Founder, WOMBATS Shield

Core is quiet network-wide protection. Edge adds SMB file sharing, Jellyfin direct play and DLNA. Vault adds encrypted local storage, Time Machine for Macs, a recycle bin, and a Vault-only Wi-Fi access point for travel. Full breakdown on the compare page.

No. Jellyfin on Shield runs in direct play / direct stream mode only. Very high bitrate 4K media may reduce concurrent stream counts.

Time Machine backup support is a Shield Vault feature, with encrypted local storage on the included SSD.

Yes, Vault ships with a 256 GB SSD, with optional 1 TB, 2 TB or 4 TB upgrades. During the founding batch we confirm the upgrade by email after your order so every Vault is built to spec.

At home, Shield's Wi-Fi stays off; your home modem provides Wi-Fi and Shield filters it. To travel, turn Shield's Wi-Fi on from the Wi-Fi page, power Shield off straight away, and pack it with its adaptor and Ethernet cable. At a hotel or AirBnB, plug the Ethernet into the modem's LAN port and power Shield on; your WOMBATS Wi-Fi appears and any device joining it gets the same filtering you have at home. When you're back, join WOMBATS Wi-Fi, open Shield, and turn the Wi-Fi off right away — until you do, no device on either Wi-Fi can reach the internet. Once it's off, your modem's Wi-Fi resumes as usual. Step-by-step in the Vault Wi-Fi guide.

Shield Core is comfortable with 20–40 connected browsing/phone/tablet/IoT devices. Shield Edge is comfortable with 15–25 browsing devices, three combined direct-play streams, and two SMB transfers. Shield Vault is comfortable with 15–25 browsing devices, three combined streams, 1–2 Time Machine backups, two SMB transfers, and 15–25 Wi-Fi AP clients. These are comfort targets, not benchmark maxima.

The first 20 Shields. Founding members get founding pricing locked in for life across our line, a numbered card in the box, a direct line to the engineers, and an invitation to the founding-members community.

Because we are small on purpose, and the first batch is hand-fulfilled. I would rather build a small, durable company with people who care about the same things we do, than a big one in a hurry. The founding batch is how we find the first 20 of those people.

, Khalid, Founder, WOMBATS Shield

20% off RRP across all three Shields. The founding price stays with founding members for any future Shield they buy from us.

On the pricing page.