diff --git a/internal/client/storage.go b/internal/client/storage.go
index df8ad2f4..59be5c36 100644
--- a/internal/client/storage.go
+++ b/internal/client/storage.go
@@ -2,10 +2,12 @@ package client
 
 import (
 	"fmt"
+	"net"
 	"net/netip"
 	"sync"
 
 	"github.com/AdguardTeam/golibs/errors"
+	"github.com/AdguardTeam/golibs/log"
 )
 
 // Storage contains information about persistent and runtime clients.
@@ -15,17 +17,13 @@ type Storage struct {
 
 	// index contains information about persistent clients.
 	index *Index
-
-	// runtimeIndex contains information about runtime clients.
-	runtimeIndex map[netip.Addr]*Runtime
 }
 
 // NewStorage returns initialized client storage.
 func NewStorage() (s *Storage) {
 	return &Storage{
-		mu:           &sync.Mutex{},
-		index:        NewIndex(),
-		runtimeIndex: map[netip.Addr]*Runtime{},
+		mu:    &sync.Mutex{},
+		index: NewIndex(),
 	}
 }
 
@@ -51,9 +49,19 @@ func (s *Storage) Add(p *Persistent) (err error) {
 
 	s.index.Add(p)
 
+	log.Debug("client storage: added %q: IDs: %q [%d]", p.Name, p.IDs(), s.index.Size())
+
 	return nil
 }
 
+// FindByName finds persistent client by name.
+func (s *Storage) FindByName(name string) (c *Persistent, found bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.index.FindByName(name)
+}
+
 // Find finds persistent client by string representation of the client ID, IP
 // address, or MAC.  And returns it shallow copy.
 func (s *Storage) Find(id string) (p *Persistent, ok bool) {
@@ -92,6 +100,14 @@ func (s *Storage) FindLoose(ip netip.Addr, id string) (p *Persistent, ok bool) {
 	return nil, false
 }
 
+// FindByMAC finds persistent client by MAC.
+func (s *Storage) FindByMAC(mac net.HardwareAddr) (c *Persistent, found bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.index.FindByMAC(mac)
+}
+
 // RemoveByName removes persistent client information.  ok is false if no such
 // client exists by that name.
 func (s *Storage) RemoveByName(name string) (ok bool) {
@@ -103,13 +119,18 @@ func (s *Storage) RemoveByName(name string) (ok bool) {
 		return false
 	}
 
+	if err := p.CloseUpstreams(); err != nil {
+		log.Error("client storage: removing client %q: %s", p.Name, err)
+	}
+
 	s.index.Delete(p)
 
 	return true
 }
 
 // Update finds the stored persistent client by its name and updates its
-// information from n.
+// information from n.  n must be valid persistent client.  See
+// [Persistent.Validate].
 func (s *Storage) Update(name string, n *Persistent) (err error) {
 	defer func() { err = errors.Annotate(err, "updating client: %w") }()
 
@@ -147,6 +168,14 @@ func (s *Storage) RangeByName(f func(c *Persistent) (cont bool)) {
 	s.index.RangeByName(f)
 }
 
+// Size returns the number of persistent clients.
+func (s *Storage) Size() (n int) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.index.Size()
+}
+
 // CloseUpstreams closes upstream configurations of persistent clients.
 func (s *Storage) CloseUpstreams() (err error) {
 	s.mu.Lock()
@@ -154,50 +183,3 @@ func (s *Storage) CloseUpstreams() (err error) {
 
 	return s.index.CloseUpstreams()
 }
-
-// ClientRuntime returns the saved runtime client by ip.  If no such client
-// exists, returns nil.
-func (s *Storage) ClientRuntime(ip netip.Addr) (rc *Runtime) {
-	return s.runtimeIndex[ip]
-}
-
-// AddRuntime saves the runtime client information in the storage.  IP address
-// of a client must be unique.  rc must not be nil.
-func (s *Storage) AddRuntime(rc *Runtime) {
-	ip := rc.Addr()
-	s.runtimeIndex[ip] = rc
-}
-
-// SizeRuntime returns the number of the runtime clients.
-func (s *Storage) SizeRuntime() (n int) {
-	return len(s.runtimeIndex)
-}
-
-// RangeRuntime calls f for each runtime client in an undefined order.
-func (s *Storage) RangeRuntime(f func(rc *Runtime) (cont bool)) {
-	for _, rc := range s.runtimeIndex {
-		if !f(rc) {
-			return
-		}
-	}
-}
-
-// DeleteRuntime removes the runtime client by ip.
-func (s *Storage) DeleteRuntime(ip netip.Addr) {
-	delete(s.runtimeIndex, ip)
-}
-
-// DeleteBySource removes all runtime clients that have information only from
-// the specified source and returns the number of removed clients.
-func (s *Storage) DeleteBySource(src Source) (n int) {
-	for ip, rc := range s.runtimeIndex {
-		rc.unset(src)
-
-		if rc.isEmpty() {
-			delete(s.runtimeIndex, ip)
-			n++
-		}
-	}
-
-	return n
-}
diff --git a/internal/client/storage_test.go b/internal/client/storage_test.go
index b00b1f69..b7b03bd8 100644
--- a/internal/client/storage_test.go
+++ b/internal/client/storage_test.go
@@ -366,7 +366,6 @@ func TestStorage_Update(t *testing.T) {
 		cli: &client.Persistent{
 			Name: "basic",
 			IPs:  []netip.Addr{netip.MustParseAddr("1.1.1.1")},
-			UID:  client.MustNewUID(),
 		},
 		wantErrMsg: "",
 	}, {
diff --git a/internal/home/clients.go b/internal/home/clients.go
index 72c14178..e924ce43 100644
--- a/internal/home/clients.go
+++ b/internal/home/clients.go
@@ -44,8 +44,8 @@ type DHCP interface {
 
 // clientsContainer is the storage of all runtime and persistent clients.
 type clientsContainer struct {
-	// clientIndex stores information about persistent clients.
-	clientIndex *client.Index
+	// storage stores information about persistent clients.
+	storage *client.Storage
 
 	// runtimeIndex stores information about runtime clients.
 	runtimeIndex *client.RuntimeIndex
@@ -103,13 +103,13 @@ func (clients *clientsContainer) Init(
 	filteringConf *filtering.Config,
 ) (err error) {
 	// TODO(s.chzhen):  Refactor it.
-	if clients.clientIndex != nil {
+	if clients.storage != nil {
 		return errors.Error("clients container already initialized")
 	}
 
 	clients.runtimeIndex = client.NewRuntimeIndex()
 
-	clients.clientIndex = client.NewIndex()
+	clients.storage = client.NewStorage()
 
 	clients.allTags = container.NewMapSet(clientTags...)
 
@@ -285,17 +285,14 @@ func (clients *clientsContainer) addFromConfig(
 			return fmt.Errorf("clients: init persistent client at index %d: %w", i, err)
 		}
 
-		// TODO(s.chzhen):  Consider moving to the client index constructor.
-		err = clients.clientIndex.ClashesUID(cli)
+		err = cli.Validate(clients.allTags)
 		if err != nil {
-			return fmt.Errorf("adding client %s at index %d: %w", cli.Name, i, err)
+			return fmt.Errorf("validating client %s at index %d: %w", cli.Name, i, err)
 		}
 
-		err = clients.add(cli)
+		err = clients.storage.Add(cli)
 		if err != nil {
-			// TODO(s.chzhen):  Return an error instead of logging if more
-			// stringent requirements are implemented.
-			log.Error("clients: adding client %s at index %d: %s", cli.Name, i, err)
+			return fmt.Errorf("adding client %s at index %d: %w", cli.Name, i, err)
 		}
 	}
 
@@ -308,8 +305,8 @@ func (clients *clientsContainer) forConfig() (objs []*clientObject) {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()
 
-	objs = make([]*clientObject, 0, clients.clientIndex.Size())
-	clients.clientIndex.RangeByName(func(cli *client.Persistent) (cont bool) {
+	objs = []*clientObject{}
+	clients.storage.RangeByName(func(cli *client.Persistent) (cont bool) {
 		objs = append(objs, &clientObject{
 			Name: cli.Name,
 
@@ -336,7 +333,7 @@ func (clients *clientsContainer) forConfig() (objs []*clientObject) {
 		return true
 	})
 
-	return objs
+	return slices.Clip(objs)
 }
 
 // arpClientsUpdatePeriod defines how often ARP clients are updated.
@@ -412,12 +409,8 @@ func (clients *clientsContainer) clientOrArtificial(
 		}
 	}()
 
-	cli, ok := clients.find(id)
-	if !ok {
-		cli = clients.clientIndex.FindByIPWithoutZone(ip)
-	}
-
-	if cli != nil {
+	cli, ok := clients.storage.FindLoose(ip, id)
+	if ok {
 		return &querylog.Client{
 			Name:           cli.Name,
 			IgnoreQueryLog: cli.IgnoreQueryLog,
@@ -523,7 +516,7 @@ func (clients *clientsContainer) UpstreamConfigByID(
 // findLocked searches for a client by its ID.  clients.lock is expected to be
 // locked.
 func (clients *clientsContainer) findLocked(id string) (c *client.Persistent, ok bool) {
-	c, ok = clients.clientIndex.Find(id)
+	c, ok = clients.storage.Find(id)
 	if ok {
 		return c, true
 	}
@@ -545,7 +538,7 @@ func (clients *clientsContainer) findDHCP(ip netip.Addr) (c *client.Persistent,
 		return nil, false
 	}
 
-	return clients.clientIndex.FindByMAC(foundMAC)
+	return clients.storage.FindByMAC(foundMAC)
 }
 
 // runtimeClient returns a runtime client from internal index.  Note that it
@@ -579,114 +572,6 @@ func (clients *clientsContainer) findRuntimeClient(ip netip.Addr) (rc *client.Ru
 	return rc
 }
 
-// check validates the client.  It also sorts the client tags.
-func (clients *clientsContainer) check(c *client.Persistent) (err error) {
-	switch {
-	case c == nil:
-		return errors.Error("client is nil")
-	case c.Name == "":
-		return errors.Error("invalid name")
-	case c.IDsLen() == 0:
-		return errors.Error("id required")
-	default:
-		// Go on.
-	}
-
-	for _, t := range c.Tags {
-		if !clients.allTags.Has(t) {
-			return fmt.Errorf("invalid tag: %q", t)
-		}
-	}
-
-	// TODO(s.chzhen):  Move to the constructor.
-	slices.Sort(c.Tags)
-
-	_, err = proxy.ParseUpstreamsConfig(c.Upstreams, &upstream.Options{})
-	if err != nil {
-		return fmt.Errorf("invalid upstream servers: %w", err)
-	}
-
-	return nil
-}
-
-// add adds a persistent client or returns an error.
-func (clients *clientsContainer) add(c *client.Persistent) (err error) {
-	err = clients.check(c)
-	if err != nil {
-		// Don't wrap the error since it's informative enough as is.
-		return err
-	}
-
-	clients.lock.Lock()
-	defer clients.lock.Unlock()
-
-	err = clients.clientIndex.Clashes(c)
-	if err != nil {
-		// Don't wrap the error since it's informative enough as is.
-		return err
-	}
-
-	clients.addLocked(c)
-
-	log.Debug("clients: added %q: ID:%q [%d]", c.Name, c.IDs(), clients.clientIndex.Size())
-
-	return nil
-}
-
-// addLocked c to the indexes.  clients.lock is expected to be locked.
-func (clients *clientsContainer) addLocked(c *client.Persistent) {
-	clients.clientIndex.Add(c)
-}
-
-// remove removes a client.  ok is false if there is no such client.
-func (clients *clientsContainer) remove(name string) (ok bool) {
-	clients.lock.Lock()
-	defer clients.lock.Unlock()
-
-	c, ok := clients.clientIndex.FindByName(name)
-	if !ok {
-		return false
-	}
-
-	clients.removeLocked(c)
-
-	return true
-}
-
-// removeLocked removes c from the indexes.  clients.lock is expected to be
-// locked.
-func (clients *clientsContainer) removeLocked(c *client.Persistent) {
-	if err := c.CloseUpstreams(); err != nil {
-		log.Error("client container: removing client %s: %s", c.Name, err)
-	}
-
-	// Update the ID index.
-	clients.clientIndex.Delete(c)
-}
-
-// update updates a client by its name.
-func (clients *clientsContainer) update(prev, c *client.Persistent) (err error) {
-	err = clients.check(c)
-	if err != nil {
-		// Don't wrap the error since it's informative enough as is.
-		return err
-	}
-
-	clients.lock.Lock()
-	defer clients.lock.Unlock()
-
-	err = clients.clientIndex.Clashes(c)
-	if err != nil {
-		// Don't wrap the error since it's informative enough as is.
-		return err
-	}
-
-	clients.removeLocked(prev)
-	clients.addLocked(c)
-
-	return nil
-}
-
 // setWHOISInfo sets the WHOIS information for a client.  clients.lock is
 // expected to be locked.
 func (clients *clientsContainer) setWHOISInfo(ip netip.Addr, wi *whois.Info) {
@@ -848,5 +733,5 @@ func (clients *clientsContainer) addFromSystemARP() {
 // close gracefully closes all the client-specific upstream configurations of
 // the persistent clients.
 func (clients *clientsContainer) close() (err error) {
-	return clients.clientIndex.CloseUpstreams()
+	return clients.storage.CloseUpstreams()
 }
diff --git a/internal/home/clients_internal_test.go b/internal/home/clients_internal_test.go
index d371df7b..5a0ba470 100644
--- a/internal/home/clients_internal_test.go
+++ b/internal/home/clients_internal_test.go
@@ -72,7 +72,7 @@ func TestClients(t *testing.T) {
 			IPs:  []netip.Addr{cli1IP, cliIPv6},
 		}
 
-		err := clients.add(c)
+		err := clients.storage.Add(c)
 		require.NoError(t, err)
 
 		c = &client.Persistent{
@@ -81,7 +81,7 @@ func TestClients(t *testing.T) {
 			IPs:  []netip.Addr{cli2IP},
 		}
 
-		err = clients.add(c)
+		err = clients.storage.Add(c)
 		require.NoError(t, err)
 
 		c, ok := clients.find(cli1)
@@ -106,31 +106,6 @@ func TestClients(t *testing.T) {
 		assert.Equal(t, clients.clientSource(cli2IP), client.SourcePersistent)
 	})
 
-	t.Run("add_fail_name", func(t *testing.T) {
-		err := clients.add(&client.Persistent{
-			Name: "client1",
-			UID:  client.MustNewUID(),
-			IPs:  []netip.Addr{netip.MustParseAddr("1.2.3.5")},
-		})
-		require.Error(t, err)
-	})
-
-	t.Run("add_fail_ip", func(t *testing.T) {
-		err := clients.add(&client.Persistent{
-			Name: "client3",
-			UID:  client.MustNewUID(),
-		})
-		require.Error(t, err)
-	})
-
-	t.Run("update_fail_ip", func(t *testing.T) {
-		err := clients.update(&client.Persistent{Name: "client1"}, &client.Persistent{
-			Name: "client1",
-			UID:  client.MustNewUID(),
-		})
-		assert.Error(t, err)
-	})
-
 	t.Run("update_success", func(t *testing.T) {
 		var (
 			cliOld = "1.1.1.1"
@@ -139,11 +114,11 @@ func TestClients(t *testing.T) {
 			cliNewIP = netip.MustParseAddr(cliNew)
 		)
 
-		prev, ok := clients.clientIndex.FindByName("client1")
+		prev, ok := clients.storage.FindByName("client1")
 		require.True(t, ok)
 		require.NotNil(t, prev)
 
-		err := clients.update(prev, &client.Persistent{
+		err := clients.storage.Update("client1", &client.Persistent{
 			Name: "client1",
 			UID:  prev.UID,
 			IPs:  []netip.Addr{cliNewIP},
@@ -155,11 +130,11 @@ func TestClients(t *testing.T) {
 
 		assert.Equal(t, clients.clientSource(cliNewIP), client.SourcePersistent)
 
-		prev, ok = clients.clientIndex.FindByName("client1")
+		prev, ok = clients.storage.FindByName("client1")
 		require.True(t, ok)
 		require.NotNil(t, prev)
 
-		err = clients.update(prev, &client.Persistent{
+		err = clients.storage.Update("client1", &client.Persistent{
 			Name:           "client1-renamed",
 			UID:            prev.UID,
 			IPs:            []netip.Addr{cliNewIP},
@@ -173,7 +148,7 @@ func TestClients(t *testing.T) {
 		assert.Equal(t, "client1-renamed", c.Name)
 		assert.True(t, c.UseOwnSettings)
 
-		nilCli, ok := clients.clientIndex.FindByName("client1")
+		nilCli, ok := clients.storage.FindByName("client1")
 		require.False(t, ok)
 
 		assert.Nil(t, nilCli)
@@ -184,7 +159,7 @@ func TestClients(t *testing.T) {
 	})
 
 	t.Run("del_success", func(t *testing.T) {
-		ok := clients.remove("client1-renamed")
+		ok := clients.storage.RemoveByName("client1-renamed")
 		require.True(t, ok)
 
 		_, ok = clients.find("1.1.1.2")
@@ -192,7 +167,7 @@ func TestClients(t *testing.T) {
 	})
 
 	t.Run("del_fail", func(t *testing.T) {
-		ok := clients.remove("client3")
+		ok := clients.storage.RemoveByName("client3")
 		assert.False(t, ok)
 	})
 
@@ -261,7 +236,7 @@ func TestClientsWHOIS(t *testing.T) {
 	t.Run("can't_set_manually-added", func(t *testing.T) {
 		ip := netip.MustParseAddr("1.1.1.2")
 
-		err := clients.add(&client.Persistent{
+		err := clients.storage.Add(&client.Persistent{
 			Name: "client1",
 			UID:  client.MustNewUID(),
 			IPs:  []netip.Addr{netip.MustParseAddr("1.1.1.2")},
@@ -272,7 +247,7 @@ func TestClientsWHOIS(t *testing.T) {
 		rc := clients.runtimeIndex.Client(ip)
 		require.Nil(t, rc)
 
-		assert.True(t, clients.remove("client1"))
+		assert.True(t, clients.storage.RemoveByName("client1"))
 	})
 }
 
@@ -283,7 +258,7 @@ func TestClientsAddExisting(t *testing.T) {
 		ip := netip.MustParseAddr("1.1.1.1")
 
 		// Add a client.
-		err := clients.add(&client.Persistent{
+		err := clients.storage.Add(&client.Persistent{
 			Name:    "client1",
 			UID:     client.MustNewUID(),
 			IPs:     []netip.Addr{ip, netip.MustParseAddr("1:2:3::4")},
@@ -333,7 +308,7 @@ func TestClientsAddExisting(t *testing.T) {
 		require.NoError(t, err)
 
 		// Add a new client with the same IP as for a client with MAC.
-		err = clients.add(&client.Persistent{
+		err = clients.storage.Add(&client.Persistent{
 			Name: "client2",
 			UID:  client.MustNewUID(),
 			IPs:  []netip.Addr{ip},
@@ -341,7 +316,7 @@ func TestClientsAddExisting(t *testing.T) {
 		require.NoError(t, err)
 
 		// Add a new client with the IP from the first client's IP range.
-		err = clients.add(&client.Persistent{
+		err = clients.storage.Add(&client.Persistent{
 			Name: "client3",
 			UID:  client.MustNewUID(),
 			IPs:  []netip.Addr{netip.MustParseAddr("2.2.2.2")},
@@ -354,7 +329,7 @@ func TestClientsCustomUpstream(t *testing.T) {
 	clients := newClientsContainer(t)
 
 	// Add client with upstreams.
-	err := clients.add(&client.Persistent{
+	err := clients.storage.Add(&client.Persistent{
 		Name: "client1",
 		UID:  client.MustNewUID(),
 		IPs:  []netip.Addr{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("1:2:3::4")},
diff --git a/internal/home/clientshttp.go b/internal/home/clientshttp.go
index 40a91f86..aea5fcea 100644
--- a/internal/home/clientshttp.go
+++ b/internal/home/clientshttp.go
@@ -96,7 +96,7 @@ func (clients *clientsContainer) handleGetClients(w http.ResponseWriter, r *http
 	clients.lock.Lock()
 	defer clients.lock.Unlock()
 
-	clients.clientIndex.Range(func(c *client.Persistent) (cont bool) {
+	clients.storage.RangeByName(func(c *client.Persistent) (cont bool) {
 		cj := clientToJSON(c)
 		data.Clients = append(data.Clients, cj)
 
@@ -336,7 +336,14 @@ func (clients *clientsContainer) handleAddClient(w http.ResponseWriter, r *http.
 		return
 	}
 
-	err = clients.add(c)
+	err = c.Validate(clients.allTags)
+	if err != nil {
+		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)
+
+		return
+	}
+
+	err = clients.storage.Add(c)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)
 
@@ -364,7 +371,7 @@ func (clients *clientsContainer) handleDelClient(w http.ResponseWriter, r *http.
 		return
 	}
 
-	if !clients.remove(cj.Name) {
+	if !clients.storage.RemoveByName(cj.Name) {
 		aghhttp.Error(r, w, http.StatusBadRequest, "Client not found")
 
 		return
@@ -399,30 +406,21 @@ func (clients *clientsContainer) handleUpdateClient(w http.ResponseWriter, r *ht
 		return
 	}
 
-	var prev *client.Persistent
-	var ok bool
-
-	func() {
-		clients.lock.Lock()
-		defer clients.lock.Unlock()
-
-		prev, ok = clients.clientIndex.FindByName(dj.Name)
-	}()
-
-	if !ok {
-		aghhttp.Error(r, w, http.StatusBadRequest, "client not found")
-
-		return
-	}
-
-	c, err := clients.jsonToClient(dj.Data, prev)
+	c, err := clients.jsonToClient(dj.Data, nil)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)
 
 		return
 	}
 
-	err = clients.update(prev, c)
+	err = c.Validate(clients.allTags)
+	if err != nil {
+		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)
+
+		return
+	}
+
+	err = clients.storage.Update(dj.Name, c)
 	if err != nil {
 		aghhttp.Error(r, w, http.StatusBadRequest, "%s", err)
 
diff --git a/internal/home/clientshttp_internal_test.go b/internal/home/clientshttp_internal_test.go
index dc1aa87d..f72a346f 100644
--- a/internal/home/clientshttp_internal_test.go
+++ b/internal/home/clientshttp_internal_test.go
@@ -198,11 +198,11 @@ func TestClientsContainer_HandleDelClient(t *testing.T) {
 	clients := newClientsContainer(t)
 
 	clientOne := newPersistentClientWithIDs(t, "client1", []string{testClientIP1})
-	err := clients.add(clientOne)
+	err := clients.storage.Add(clientOne)
 	require.NoError(t, err)
 
 	clientTwo := newPersistentClientWithIDs(t, "client2", []string{testClientIP2})
-	err = clients.add(clientTwo)
+	err = clients.storage.Add(clientTwo)
 	require.NoError(t, err)
 
 	assertPersistentClients(t, clients, []*client.Persistent{clientOne, clientTwo})
@@ -260,7 +260,7 @@ func TestClientsContainer_HandleUpdateClient(t *testing.T) {
 	clients := newClientsContainer(t)
 
 	clientOne := newPersistentClientWithIDs(t, "client1", []string{testClientIP1})
-	err := clients.add(clientOne)
+	err := clients.storage.Add(clientOne)
 	require.NoError(t, err)
 
 	assertPersistentClients(t, clients, []*client.Persistent{clientOne})
@@ -342,11 +342,11 @@ func TestClientsContainer_HandleFindClient(t *testing.T) {
 	}
 
 	clientOne := newPersistentClientWithIDs(t, "client1", []string{testClientIP1})
-	err := clients.add(clientOne)
+	err := clients.storage.Add(clientOne)
 	require.NoError(t, err)
 
 	clientTwo := newPersistentClientWithIDs(t, "client2", []string{testClientIP2})
-	err = clients.add(clientTwo)
+	err = clients.storage.Add(clientTwo)
 	require.NoError(t, err)
 
 	assertPersistentClients(t, clients, []*client.Persistent{clientOne, clientTwo})
diff --git a/internal/home/dns_internal_test.go b/internal/home/dns_internal_test.go
index 8413e2a3..b5014672 100644
--- a/internal/home/dns_internal_test.go
+++ b/internal/home/dns_internal_test.go
@@ -13,17 +13,18 @@ import (
 
 var testIPv4 = netip.AddrFrom4([4]byte{1, 2, 3, 4})
 
-// newIDIndex is a helper function that returns a client index filled with
+// newStorage is a helper function that returns a client index filled with
 // persistent clients from the m.  It also generates a UID for each client.
-func newIDIndex(m []*client.Persistent) (ci *client.Index) {
-	ci = client.NewIndex()
+func newStorage(tb testing.TB, m []*client.Persistent) (s *client.Storage) {
+	tb.Helper()
 
+	s = client.NewStorage()
 	for _, c := range m {
 		c.UID = client.MustNewUID()
-		ci.Add(c)
+		require.NoError(tb, s.Add(c))
 	}
 
-	return ci
+	return s
 }
 
 func TestApplyAdditionalFiltering(t *testing.T) {
@@ -36,7 +37,8 @@ func TestApplyAdditionalFiltering(t *testing.T) {
 	}, nil)
 	require.NoError(t, err)
 
-	Context.clients.clientIndex = newIDIndex([]*client.Persistent{{
+	Context.clients.storage = newStorage(t, []*client.Persistent{{
+		Name:                "default",
 		ClientIDs:           []string{"default"},
 		UseOwnSettings:      false,
 		SafeSearchConf:      filtering.SafeSearchConfig{Enabled: false},
@@ -44,6 +46,7 @@ func TestApplyAdditionalFiltering(t *testing.T) {
 		SafeBrowsingEnabled: false,
 		ParentalEnabled:     false,
 	}, {
+		Name:                "custom_filtering",
 		ClientIDs:           []string{"custom_filtering"},
 		UseOwnSettings:      true,
 		SafeSearchConf:      filtering.SafeSearchConfig{Enabled: true},
@@ -51,6 +54,7 @@ func TestApplyAdditionalFiltering(t *testing.T) {
 		SafeBrowsingEnabled: true,
 		ParentalEnabled:     true,
 	}, {
+		Name:                "partial_custom_filtering",
 		ClientIDs:           []string{"partial_custom_filtering"},
 		UseOwnSettings:      true,
 		SafeSearchConf:      filtering.SafeSearchConfig{Enabled: true},
@@ -121,16 +125,19 @@ func TestApplyAdditionalFiltering_blockedServices(t *testing.T) {
 	}, nil)
 	require.NoError(t, err)
 
-	Context.clients.clientIndex = newIDIndex([]*client.Persistent{{
+	Context.clients.storage = newStorage(t, []*client.Persistent{{
+		Name:                  "default",
 		ClientIDs:             []string{"default"},
 		UseOwnBlockedServices: false,
 	}, {
+		Name:      "no_services",
 		ClientIDs: []string{"no_services"},
 		BlockedServices: &filtering.BlockedServices{
 			Schedule: schedule.EmptyWeekly(),
 		},
 		UseOwnBlockedServices: true,
 	}, {
+		Name:      "services",
 		ClientIDs: []string{"services"},
 		BlockedServices: &filtering.BlockedServices{
 			Schedule: schedule.EmptyWeekly(),
@@ -138,6 +145,7 @@ func TestApplyAdditionalFiltering_blockedServices(t *testing.T) {
 		},
 		UseOwnBlockedServices: true,
 	}, {
+		Name:      "invalid_services",
 		ClientIDs: []string{"invalid_services"},
 		BlockedServices: &filtering.BlockedServices{
 			Schedule: schedule.EmptyWeekly(),
@@ -145,6 +153,7 @@ func TestApplyAdditionalFiltering_blockedServices(t *testing.T) {
 		},
 		UseOwnBlockedServices: true,
 	}, {
+		Name:      "allow_all",
 		ClientIDs: []string{"allow_all"},
 		BlockedServices: &filtering.BlockedServices{
 			Schedule: schedule.FullWeekly(),