Step 01
Plug it in
Ethernet from your modem to Shield. Power on. Join the Wi-Fi network Shield broadcasts — or open the local setup page from any browser on your network.
A calm appliance behind your modem. Wi-Fi stays the same.
Shield connects to your existing modem over Ethernet. Your phones, laptops and TVs keep using the Wi-Fi they already use. Filtering decisions and the dashboard run on the device on your network, not in someone else's cloud.
“This is the architecture I would build if I were the buyer. Local-first because protection should not depend on a third party. Signed updates because you should be able to verify what is running on your device. Public filter lists because trust is something you earn one inspectable line at a time.”— Founder, WOMBATS Shield
Modem Autopilot
Works out of the box. The whole network in about fifteen minutes.
Every Shield broadcasts its own Wi-Fi as soon as it's switched on. Join it and you're behind the filter straight away — nothing to configure. That Wi-Fi is deliberately modest, made for setting up and small spaces. To protect every device on your home network, run setup: about fifteen minutes, with Modem Autopilot recognising your modem and making the changes for you.
Step 02
It finds your modem
Have your modem's admin login handy — the one printed on the modem's sticker. Press one button and Modem Autopilot recognises your modem and applies the right DNS and DHCP settings for you.
Step 03
Confirm and forget
Apply the settings. From this point on every device on your network goes through Shield.
For step-by-step instructions on each page of Shield's local dashboard, see the owner guides.
Will it work with my modem?
Works with the modems in most Australian homes
Modem Autopilot recognises many modems from these internet providers and brands.
Providers
TelstraOptusTPGiiNetInternodeAussie BroadbandBelongVodafoneDodoiPrimusMateSuperloopExetelSpintel
Modem brands
TP-LinkNetgearASUSD-LinkHuaweiSagemcomNetCommTechnicolorNokiaZTEArcadyanSercomm
Talk to us before ordering
These are set up through their own phone app, so Modem Autopilot can't change their settings — that includes the eero routers Superloop and Aussie Broadband offer. Tell us what you have and we'll say plainly whether Shield suits your home.
StarlinkeeroGoogle Nest WifiGoogle WifiTP-Link Deco
Have one of these, or another router you can only set up in a phone app?
Tested on real hardware with modems that Telstra, Optus, TPG, iiNet and Vodafone have supplied, and with retail TP-Link and NetComm modems. If your provider sent you a new modem recently, tell us which one you have. Other mesh Wi-Fi systems, double-NAT and ISP-locked routers can need extra steps as well. If you have one of these, or your network setup is unusual, talk to us before ordering — founding members get hands-on setup help.
How it fits.
For the whole house, your modem hands the network over to Shield. Your Wi-Fi name stays. Your coverage stays. Nothing gets re-paired — every phone, laptop and TV already on your network is simply protected from then on. And removing it one day is just as honest: take Shield out, factory-reset the modem, and you're exactly where you started.
See exactly what Shield is doing, quietly.
No telemetry leaves your house. The dashboard runs on Shield itself, on your network. Pause a device, exclude a category, or just leave it alone for months.
At a glance
Whether protection is on, how the network is doing, and which sites were blocked most, all counted on the Shield itself.
Shield Vault shown
Each device, on its own terms
Pause a device or set its internet hours without touching the rest of the house. On Edge and Vault, give one device its own SafeSearch and blocked apps, even just on school nights.
On Shield Edge and Vault
Tune protection to your household
Choose how strictly each kind of site is filtered, or pause protection for a while.
Real screens from a Shield Vault, with demo settings. Device names, network addresses and a few internal details are blurred.
The path of a single request.
When a device on your network tries to reach a website or service, it almost always starts with a DNS lookup. Shield evaluates that lookup against your active filter sources and policy, then either finds the address or stops it at the door.
- Step 01
Device asks
A laptop, phone or TV asks the network: "where is example.com?"
- Step 02
Shield checks policy
Shield evaluates the lookup against your active filter lists, household categories and per-device policy.
- Step 03
Allow or block
If blocked, the connection never starts — quietly. If allowed, Shield finds the address: at home it asks the internet's own address servers itself, so no DNS company sees your household's lookups; away from home it sends an encrypted lookup to a provider you choose — Cloudflare by default.
- Step 04
Local-only enforcement
Local nftables rules resist common encrypted-DNS bypass paths and Apple Private Relay traffic on the network.
Built on trusted open technology, then carefully hardened.
- Raspberry Pi 5 hardware baseline. A single-board computer, the same board across Core, Edge and Vault. Real, repairable, well-documented silicon with a long supply life.
- Debian 12 base system. A long-term Linux base with a known security track record and a predictable patch pipeline.
- AdGuard Home, restricted defaults. AdGuard provides the DNS-layer filtering engine. We've intentionally restricted, disabled or redesigned features that conflicted with our privacy and security goals, including default query logging behaviour and remote-management exposure.
- nftables enforcement. Local redirect, port-block and forward-chain rules to resist common DNS-bypass paths and Apple Private Relay traffic.
- Signed update bundles. Software lands as a complete, signed bundle. The device verifies the signature before applying. No ad-hoc remote changes.
- Hardware-assisted unlock. Shield's encrypted partitions are unlocked at boot through a key path burned into the board's own one-time-programmable silicon. The unlock key is bound to the device and cannot be lifted off and used elsewhere.
- Vault SSD, three unlock paths by design. On Shield Vault, with encryption switched on when you first set up the drive, the storage SSD is designed around three unlock paths: an auto-unlock key bound to the device's own silicon, used at boot; a user passphrase; and a recovery key for you to save.
- Separate payload & storage partitions (Vault). Shield Vault keeps the encrypted system partition separate from the storage partition that holds your files. With encryption switched on when you first set up the drive, each has its own silicon-bound key path.
More on the security and disclosure side at /security.
Where Shield deliberately stops
A network‑level appliance has clear boundaries. We'd rather name them up front.
- Devices outside your network — phones on mobile data, laptops on café Wi-Fi — are outside Shield's policy, unless they connect back through Vault's Follow-Me Filtering (which the phone's owner can switch off; your Shield shows when it was last connected).
- VPNs and encrypted DNS on a determined managed device can still tunnel out, Shield gives you visibility, not coercion.
- Shield does not break TLS or deep-packet-inspect every app, that's the right boundary for a calm home appliance.
- Shield is designed to sit behind your modem on a normal home or office network, not directly on the public internet.
The full version is on the Privacy & security page.
Founding Edition
Order a Shield from the founding batch.
Founding price locked in for life. No subscriptions.