–blocked

Your network is protected

Queries today

–

Blocked

–

Threats stopped

–

Devices online

–

Protection on

Activity · last 24 hours

QueriesBlocked

Top blocked

Screen time today

estimated

Most active devices

Top allowed

Blocked by

Upstream DNS

Server	Latency	Failed

Started being blocked this week

Allowed before, blocked since, usually after a list update. If something stopped working, look here first

Query log

Every DNS request on your network.

Live

Time	Device	Domain	Status	Detail

Requests

History

Devices

Discovered on your network

Clients seen in the last 24 hours that aren't named yet. Names come from your router, and MAC addresses keep devices recognised when their IP changes.

Profiles

Each profile sets filtering, safe search, blocked apps, daily limits, schedule and logging for its devices. Unassigned devices use Default.

Blocklists

Write your own lists, and choose which downloaded lists to use. Each profile then picks the lists that apply to its devices.

My lists

Lists you write here, from scratch, by pasting, or from what your devices look up. Changes apply the moment you save.

Downloaded lists

Turn a list on to download it. Lists update every day.

Add a list

Hosts files, plain domain lists and Adblock-style ||domain^ lists

Troubleshoot

Something not working? Pick what's going on, and the right tool opens.

Why is a site blocked?

Check any domain for a device: which list, rule, profile, schedule or limit decides, and allow it in one click

Look it up live

Works on one device but not another?

Compare two devices: what was blocked on one but open on the other, how their profiles differ, and what probably explains it

Not working on Works on What isn't working Part of a domain Look back

Tip: ask them to try again on both devices now, then compare the last 15 minutes.

Record a test

Not sure what's being blocked? Record a device while someone tries the app or site, then see only what happened in that time

Started being blocked this week

Names that were allowed before and are blocked now, usually after a list update. If something stopped working recently, look here first

Is every device using SecurityChettan?

A device that never asks SecurityChettan isn't filtered, and doesn't show up here at all

A device appears in SecurityChettan only once it sends SecurityChettan its lookups. This checks each of your networks (VLANs): what DHCP hands out there, which devices UniFi sees, and which of them SecurityChettan has heard from.

Rules

One rule per line. example.com also covers its subdomains. *ads* and ad?.example.* are wildcards. /^track(er)?\d*\./ is a regular expression.

Allowlist

Never blocked

Blocklist

Always blocked

Temporarily allowed

Added from the query log with “1 h”

Allow on my devices

Unblock these even if a list blocks them

Block on my devices

Block these on my devices only

Approved by your admin

Sites your admin unblocked for you permanently

Users

Give family members their own sign-in. A user only sees the devices you assign to them, and can do only what you allow.

User	Role	Devices	Last sign-in	Security	Permissions

User groups

A saved list of people to share devices with. Add a user to a group once and they get the same control over every device shared with that group.

Group	Members	Devices shared

Activity

Sign-ins and every change, newest first. Kept for a year.

When	Who	What	Details

My account

Your profile, security and how SecurityChettan looks for you.

Send me a weekly report

What you can do

Bedtime

View as another user

See SecurityChettan exactly as they do: their devices, requests and what they're allowed to do. It's read-only, ends by itself after 30 minutes, and is recorded in the activity log.

Phone notifications

Alerts on this phone or computer, with buttons such as “Allow 1 hour” right on the notification.

Appearance

Colour theme

Light or dark (Classic theme)

Accent colour

Two-factor sign-in

Off

Protect your account with a code from an authenticator app (Google Authenticator, 1Password, Authy…).

API tokens

For Home Assistant, Siri Shortcuts and scripts. A token acts as you, with your permissions.

Siri & Shortcuts

In the Shortcuts app, add a Get contents of URL action with these settings, and a header Authorization: Bearer <your token>. Then say “Hey Siri” and the shortcut's name.

Change password

Password sign-in

Current password

New password

At least 6 characters

Confirm

Settings

Everything SecurityChettan does on your network, in one place.

Filtering

How blocked answers look, caching and list updates.

General

Dashboard address

The address you open this page with, e.g. http://192.168.1.10:8080. Used for links in alerts and emails

Filtering & cache

Blocked response

Blocked response TTL

Seconds

CNAME inspection

Catch trackers hidden behind first-party domains

Update lists every

Hours

Enable cache

Optimistic cache

Answer instantly from expired entries, refresh in the background

Cache size

Entries

Flush cache

Block page & requests

What people see when a site is blocked, and who approves their requests to unblock it.

Show a block page

Blocked sites open a page saying what was blocked and why, with “Ask to unblock”. Works for http:// sites; HTTPS sites can't show it (no one can fake their certificate), so they fail quickly instead

Show it for

Ads and trackers load in the background, where a page would never be seen

Block page server

–

On Synology, DSM's web server uses port 80 on the NAS's own address. Give SecurityChettan its own IP address (see README: docker-compose.macvlan.yml) and the dashboard shows the block page itself; or enter your backup SecurityChettan's address here. The notification below works either way.

Tell the device's owner when a site is blocked

A phone notification (SecurityChettan app) with “see why” and “ask to unblock”. Never for ads and trackers, and at most hourly per site. Works for HTTPS sites too

Allow requests from the block page

Only from devices you've added and named under Devices

Requests go to

A device's owner can approve only if they have the “Approve unblock requests” permission (Users → Edit); otherwise requests go to admins

Preview

What someone on a blocked device sees

Open the block page

DNS

Where SecurityChettan sends queries, local names, and Private DNS for phones.

Upstream DNS

Servers

One per line: an IP such as 9.9.9.9, or a DNS-over-HTTPS URL

Strategy

Speed

Splits each server's time into the network itself (an answer it has cached) and looking a name up on the internet (one it doesn't have)

Conditional forwarding

Send a local domain such as lan to your router

Private reverse lookups stay local

Never send LAN PTR queries to public DNS

Local network

Unfiltered clients

IP addresses that bypass all filtering, one per line

Local DNS records

Custom names such as nas.home. Each also covers its subdomains

DNS rebinding protection

Block public names that point into your network

Stops websites from reaching your router, NAS or cameras through a domain that resolves to a LAN address. Your own hostnames, conditional forwarding and the allowlist are always exempt

Also allowed to point into your network

One domain per line, subdomains included. Plex, QuickConnect and Tailscale are here by default

Private DNS for Android (DNS-over-TLS)

Turn on Private DNS

–

Certificate

From DSM's certificate folder

Private DNS hostname

Covered by the certificate, e.g. dns.yourname.synology.me. With a wildcard certificate each device gets its own <id>.dns.… hostname, so phones are recognised anywhere

Encrypted DNS for computers & browsers (DoH)

Point Windows, a Mac or a browser at this address to get encrypted DNS on your network — Windows then shows the connection as “Encrypted” instead of “Unencrypted”. Each device is still recognised by its address, so profiles and limits keep working. Needs HTTPS turned on with a certificate the device trusts.

DNS-over-HTTPS URL (this network)

—

Windows 11 (needs 22H2 or newer) hides the option until the server is registered. In an Admin PowerShell/Command Prompt run, with this server's IP and the URL above:
netsh dns add encryption server=SERVER-IP dohtemplate=THIS-URL autoupgrade=yes udpfallback=no Then Settings → Network & internet → your adapter → DNS server assignment → Edit → Manual → IPv4 on → Preferred DNS = the same IP → DNS over HTTPS = On (automatic template). (Undo: netsh dns delete encryption server=SERVER-IP.)
Firefox (any OS): Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom → paste the URL. Chrome/Edge: Settings → Privacy → Use secure DNS → Custom → paste the URL. Away from home, use a device's own private DoH URL (on its device page).

DNS stamp (sdns://)

—

For apps or routers that ask for a DNS stamp instead of a URL (dnscrypt-proxy, AdGuard, some routers). The device still needs to trust this server's certificate. Note: if you put this in a router/gateway, the router becomes the resolver — every device then looks like the router here, so per-device profiles and limits stop working. For per-device control, point devices straight at this server instead.

Trust this server's certificate

Download certificate Only needed if you're not using a public (Let's Encrypt) certificate.

Windows: open the file → Install Certificate → Local Machine → “Place all certificates in the following store” → Trusted Root Certification Authorities. macOS: open in Keychain Access → System → double-click → Trust → Always Trust. Android: Settings → Security → Encryption & credentials → Install a certificate → CA certificate. iPhone/iPad: open the file to install the profile, then Settings → General → About → Certificate Trust Settings → turn it on.

Dynamic DNS

Keep names pointed at your home's public IP (checked every 15 minutes), or at a fixed address, through one of your DNS providers. This replaces any other A record for each name.

Devices

How devices are found, named and recognised. Names from UniFi or your router are set up under Integrations. To check that every network uses SecurityChettan, see Troubleshoot.

Device discovery

Router IP

Device names are read from your router (reverse DNS). Leave blank to use conditional forwarding

Recognise devices by MAC address

Keeps a device's profile when its IP changes. Needs host networking

Identify manufacturers

Downloads the IEEE manufacturer registry (about 4 MB, monthly) so devices can be recognised by MAC address.

Show product pictures from UniFi

When UniFi has fingerprinted a device, show its product picture (loaded by your browser from static.ui.com)

DHCP server

Hand out IP addresses from SecurityChettan instead of your router, for routers that can't share device names. Every device then uses SecurityChettan and is known by its name and MAC address. Only one DHCP server may run on a network: turn your router's off first.

Hand out addresses

Off

Address range

The addresses devices get

Gateway (router)

Subnet mask

DNS servers handed out

Leave blank for this NAS plus any backup SecurityChettan

Lease time

Hours

Local domain

Devices are reachable as name.lan through your router's DNS, if it has one

Network interface

On Synology usually eth0, ovs_eth0 or bond0

This NAS's address

Leave blank to detect it

Reserved addresses

One per line: MAC IP name. Devices with a MAC and an IP under Devices keep that IP automatically

Integrations

DNS providers, your UniFi console or router, and Home Assistant.

DNS providers

Accounts SecurityChettan can change DNS records with: hosting panels (DirectAdmin, cPanel, Plesk…), DNS services (Cloudflare, Route 53…) or your own DNS servers (BIND, PowerDNS, SSH). Certificates and dynamic DNS pick one of these.

UniFi Network

Read device names and MAC addresses from a UniFi Dream Machine, Dream Router or Cloud Gateway. Works across every VLAN, so devices stay recognised when their IP changes.

Use UniFi for device names

Off

Console address

API key

In the UniFi Network app: Settings → Control Plane → Integrations → Create API key

Local admin account

A local (not Ubiquiti cloud) account. View Only is enough for names; blocking devices needs Site Admin

Site

Usually default

Verify the console's certificate

Leave off unless you gave the console a trusted certificate. Consoles ship with a self-signed one

Block devices in UniFi when their internet is off

While a profile is paused, in bedtime, or in calendar focus time, its devices are also blocked on the network itself, so a VPN or another DNS server can't get around it. Needs a local Site Admin account

Router device names

Read device names and MAC addresses from your router's DHCP leases. For UniFi, use the UniFi card instead.

Use my router for device names

Off

Router

Address

Credentials

Verify the router's certificate

Leave off for a router's built-in self-signed certificate

Home Assistant

Adds SecurityChettan to Home Assistant: a protection switch, a “pause internet” switch per profile, presence and screen-time sensors per device. Use them in dashboards and automations.

HTTPS & sign-in

Your own hostname, HTTPS, certificates and single sign-on.

Hostname & HTTPS

Give SecurityChettan its own name and serve the dashboard over HTTPS.

Hostname

The name you'll open the dashboard with, e.g. dns.example.com

Answer this name on my network

Devices using SecurityChettan reach the NAS directly by its name

NAS address for that answer

Leave blank to detect it

HTTPS dashboard

Off

HTTPS port

DSM uses 5000/5001. Forward 443 to this port on your router to use a plain https://name

Redirect http:// to HTTPS

Only while the HTTPS dashboard is running

Dashboard certificate

–

Certificates

Let's Encrypt certificates SecurityChettan gets and renews by itself, each for its own names and through its own DNS provider. One can be the dashboard's; another can be installed into DSM after every renewal.

Let's Encrypt account

I agree to the Let's Encrypt Subscriber Agreement

Required to get certificates

Email for expiry notices

Optional. Let's Encrypt writes if renewals keep failing

Server

Use Staging while testing: generous limits, but browsers don't trust its certificates

Wait for DNS records to go live

Checks the domain's public nameservers before asking Let's Encrypt to validate

Single sign-on

Adds a “Sign in with Synology” button next to the normal sign-in. Works with DSM's SSO Server or any OpenID Connect provider. Only people who already have a SecurityChettan account can use it, and two-factor sign-in still applies.

Show the single sign-on button

Off

Button label

“Sign in with …”

Provider address

Synology: https://your-nas:5001/webman/sso, the Well-known URL shown in SSO Server → Services → OIDC

Application ID and secret

In SSO Server → Application, add an OIDC application with this redirect URI

Match accounts by

The provider field that holds the username. Synology: username. Email addresses also match

Verify the provider's certificate

Keep this on. Sign-in relies on it

Sign in with Google

Adds a “Sign in with Google” button. It signs people in to their existing SecurityChettan account when the Google address matches the account's email, or the Google account set for them under Users. It never creates accounts, and two-factor sign-in still applies.

Show the Google button

Off

Set it up in Google Cloud (free, about 5 minutes)

Open Google Cloud → APIs & Services → Credentials and create a project if asked.
OAuth consent screen: choose External, give it a name (e.g. SecurityChettan) and your email. No scopes beyond the defaults are needed.
Create credentials → OAuth client ID → Web application, and add this authorised redirect URI:
Paste the client ID and secret below.

Client ID and secret

From the OAuth client you just made

Alerts & reports

Push alerts and weekly email reports.

Alerts

New-app alerts

Tell a device's owner the first time it uses an app like TikTok or Snapchat. Needs phone notifications or an alert service below

Night-watch

A quiet nudge when a device suddenly contacts many never-seen sites at night — a new app, or possibly malware

Quiet hours

Only watch during these hours

New sites in an hour to alert

Higher means fewer alerts (default 40)

Send alerts

Push important events to your phone or chat

Service

URL

Alert me when

Phone notifications (SecurityChettan app)

Sent to admins who turned notifications on under My account. They work without the service above

Weekly email reports

Send weekly reports

To admins and to users who turned them on, with their own devices only

When

Mail server (SMTP)

Gmail: smtp.gmail.com, port 587, STARTTLS, with an app password

Certificate expiry watch

Checks the HTTPS certificates of your other sites and devices twice a day, and alerts you before they expire or if they stop being valid.

Warn this many days before

Licence

Your SecurityChettan plan, and where to enter a Pro licence key.

Your plan

Licence key

Free and Pro

Pro is a yearly subscription. To get it, email ashokjp2@gmail.com (payment by PayPal). Your key works offline: nothing is sent anywhere.

About

SecurityChettan · © 2026 SecurityChettan. All rights reserved. SecurityChettan is licensed, not sold: use is subject to the licence agreement (EULA) that came with it. It uses public blocklists under their own licences, and IP geolocation by DB-IP.

Data & integrations

Query history, Home Assistant, Prometheus and backups.

History

Log individual queries

Pause per device or profile from their pages. Hourly totals are kept for 90 days

Keep query log for

Days (1–90)

Clear all history

The activity log is kept

Monitoring & backup

Prometheus metrics

Expose /metrics for Grafana

Backup

Users, passwords and the SMTP password aren't included

Download Restore

Version history

Save snapshots automatically

A minute after settings change, once a day, and before every restore. Roll back in one click

Keep

Snapshots

Folder

To keep them on a NAS share, mount it in docker-compose.yml (e.g. /volume1/backups/dnsshield:/backups) and enter /backups. Snapshots include passwords and keys, like the settings file

Backup DNS server

Run a second SecurityChettan, on a Raspberry Pi or any Docker host, so the internet keeps working while the NAS restarts or updates. It copies profiles, devices, lists, rules and users from the main one every minute, so you sign in to it with your usual accounts. Give your router's DHCP (or SecurityChettan's) both addresses as DNS servers.

This SecurityChettan is

Name

Shown on the other server

Pairing token

Create one, then paste it into the backup server

Main server

Its dashboard address, e.g. http://192.168.1.10:8080 (HTTPS recommended)

Verify the main server's certificate

Turn off only for a self-signed certificate

Status

–

Setup checklist

A quick health check: is everything working?

Loading…

No settings match

Try another word, like “UniFi”, “certificate” or “cache”.

Unsaved changes

Welcome back

Enter your code

Forgot your password?

Choose a new password

Your network is protected

Activity · last 24 hours

Top blocked

Screen time today

Most active devices

Top allowed

Blocked by

Upstream DNS

Started being blocked this week

Query log

Requests

History

Devices

Discovered on your network

Profiles

Blocklists

My lists

Downloaded lists

Add a list

Troubleshoot

Why is a site blocked?

Works on one device but not another?

Record a test

Started being blocked this week

Is every device using SecurityChettan?

Rules

Allowlist

Blocklist

Temporarily allowed

Allow on my devices

Block on my devices

Approved by your admin

Users

User groups

Activity

My account

What you can do

Bedtime

View as another user

Phone notifications

Appearance

Two-factor sign-in

API tokens

Siri & Shortcuts

Change password

Settings

Filtering

General

Filtering & cache

Block page & requests

DNS

Upstream DNS

Local network

DNS rebinding protection

Private DNS for Android (DNS-over-TLS)

Encrypted DNS for computers & browsers (DoH)

Dynamic DNS

Devices

Device discovery

DHCP server

Integrations

DNS providers

UniFi Network

Router device names

Home Assistant

HTTPS & sign-in

Hostname & HTTPS

Certificates

Let's Encrypt account

Single sign-on

Sign in with Google

Alerts & reports

Alerts

Weekly email reports

Certificate expiry watch

Licence