Ferrite ghcr.io/koroblabs/ferrite-server:latest https://github.com/koroblabs/ferrite-server/pkgs/container/ferrite-server bridge sh false https://github.com/koroblabs/ferrite-server/issues https://github.com/koroblabs/ferrite-server Ferrite is a self-hosted DNS filter and router for the home network. It blocks ads, trackers and malware for every device; applies per-device profiles — blocked services such as TikTok or Roblox, weekly schedules, SafeSearch and YouTube Restricted Mode, default-deny; and sends chosen domains, services or devices through built-in WireGuard (kernel-backed for line-rate throughput where the host allows it, in-process userspace otherwise), SOCKS5/Tor or a DPI-evasion path. Encrypted upstreams (DoH/DoT/DoQ), a live query log and per-device activity, notifications to ntfy, Telegram, Discord or a webhook, and a REST API — one Rust binary, configured from its web panel. Network:DNS Network:VPN Network:Management Security: http://[IP]:[PORT:80]/ https://raw.githubusercontent.com/koroblabs/ferrite-unraid/main/ferrite/ferrite.xml https://raw.githubusercontent.com/koroblabs/ferrite-unraid/main/icons/ferrite.png --cap-add=NET_BIND_SERVICE --cap-add=NET_ADMIN Ports 53 TCP/UDP and 80 TCP must be available on the selected Unraid network/IP; the selective-routing (tunnels) feature additionally needs 443 TCP reachable unmapped. A custom Docker network or fixed IP (br0) is recommended: the Unraid web UI often already uses host ports 80/443, and routed domains require clients to reach Ferrite on the real ports 80/443. All Ferrite config, SQLite data, blocklist cache, snapshots, and web assets are stored under /mnt/user/appdata/ferrite. The template grants NET_BIND_SERVICE (to bind port 53 without running as root) and NET_ADMIN (for kernel-mode WireGuard tunnels: Ferrite creates its own wg interface over netlink and routes only its own traffic through it, never touching the host routing table). Kernel mode also needs the wireguard module on the Unraid host, which is present on 6.9 and newer; without it Ferrite falls back to the userspace tunnel automatically and logs which backend it picked. /mnt/user/appdata/ferrite 53 53 80 443 latest