Your router is the gate
Every device on your home Wi-Fi talks to the internet through one router. The router hands out local addresses, routes traffic out to your ISP, and — critically — tells every device which DNS server to use. That last point is the whole lever.
Local addresses
Devices on your network get private addresses, usually in 192.168.x.x or 10.x.x.x. Those addresses are not reachable from the internet. Your router translates them to your public IP when traffic leaves. From the outside, your network looks like one device. From the inside, each device is distinguishable by its local address.
Where DNS enters
When a device wants to resolve a name, it asks whatever DNS server the router told it to use. If you change the router's DNS setting to point at Heron, every device that obeys the router's DHCP configuration will send its lookups through Heron. No per-device configuration needed.
What does not obey the router
Some devices and apps are configured to use hardcoded DNS servers — 8.8.8.8 and 1.1.1.1 are common. These bypass the router setting and will not appear in Heron's log. The long-term answer is encrypted DNS, but awareness of which apps override your settings is itself useful.
If a device's traffic never appears in the log, that is a signal — not a failure. It tells you that device is bypassing the path you set.
Ports and protocols
DNS is the visible part because it is plain and universal. Most other traffic — web, video, app telemetry — is encrypted over HTTPS and cannot be inspected by content. DNS tells you the destination; the rest is opaque by design. That is enough to see what your devices are doing without seeing what they are saying.