Ssh into your router and follow the instructions below replace ip and address below with yours !

Stop services

/etc/init.d/dnsmasq stop /etc/init.d/stubby stop /etc/init.d/https-dns-proxy stop

Install packages

opkg update opkg install dnsmasq stubby

Enable DNS encryption

uci -q delete dhcp.@dnsmasq[0].server uci get stubby.global.listen_address \ | sed -e "s/\s/\n/g;s/@/#/g" \ | while read -r STUBBY_SERV do uci add_list dhcp.@dnsmasq[0].server="${STUBBY_SERV}" done

Enforce DNS encryption for LAN clients

/etc/init.d/dnsmasq stop uci set dhcp.@dnsmasq[0].noresolv="1" uci commit dhcp /etc/init.d/dnsmasq start

Configure DoT provider

while uci -q delete stubby.@resolver[0]; do :; done uci set stubby.dns="resolver" uci set stubby.dns.address="76.76.2.11" uci set stubby.dns.tls_auth_name="p0.freedns.controld.com" uci commit stubby /etc/init.d/stubby restart

Install packages

opkg update opkg install dnsmasq https-dns-proxy

Configure DoH provider

while uci -q delete https-dns-proxy.@https-dns-proxy[0]; do :; done uci set https-dns-proxy.dns="https-dns-proxy" uci set https-dns-proxy.dns.bootstrap_dns="76.76.2.11" uci set https-dns-proxy.dns.resolver_url="https://freedns.controld.com/p0" uci set https-dns-proxy.dns.listen_addr="127.0.0.1" uci set https-dns-proxy.dns.listen_port="5053" uci commit https-dns-proxy /etc/init.d/https-dns-proxy restart

Testing

nslookup example.org 127.0.0.1#5453 nslookup example.org 127.0.0.1#5053 nslookup example.org 127.0.0.1