OpenWRT - Configure DNS-over-HTTPS (DoH)

In this video, we are going to configure DNS over HTTPS on OpenWRT LuCI to secure the DNS queries that come from LAN devices to the internet. If you want configure DNS-over-TLS, you can check out the tutorial on the link below.
In order to configure DoH, we will need 2 main packages - dnsmasq which is the default DNS resolver for OpenWRT and https-dns-proxy. Besides, you will need luci-app-https-dns-proxy in order to monitor & configure DoH on LuCI. https-dns-proxy uses Google and Cloudflare as default DoH providers and we are fine with that.

Videotimeframe:

00:00 - DNS-over-HTTPS with Dnsmasq and https-dns-proxy
00:36 - Install required packages
01:52 - Access https-dns-proxy on LuCI
03:28 - DNS leak test
04:23 - Setup our your preferred DoH provider
04:55 - Force DNS request to port 53 to https-dns-proxy

Custom Firewall rule:
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j DNAT --to 192.168.1.1:5053
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j DNAT --to 192.168.1.1:5053
ptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j DNAT --to 192.168.1.1:5054
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j DNAT --to 192.168.1.1:5054

Resources:

Thanks for watching and see you in the next video!

[tungbbq]

I didn't see function Custom Rules tab on the OpenWRT admin page from Network\Firewall\. How I use this function? I used version OpenWrt 22.03.5 r20134-5f15225c1e / LuCI openwrt-22.03 branch git-23.093.57104-ce20b4a

[paulstejskal]

Thank you for this. How does this work with ipv6? I tried configuring regular dns and just found ipv6 was just totally blocked causing things not to load in my phone apps.

[mistamal]

Van thank you so much for these great practical tutorials. Just a couple of questions:
1- is the custom firewall rule necessary if the DNS forwarding setting is configured in the DHCP tab? Would keeping the firewall rule and removing the DHCP configuration still keep DOH enabled?
2- I have tried installing both adblock and DOH (basically filter out all unwanted urls before they are sent to the DOH service for encryption) but they seem to interfere as they both use dnsmasq. Unfortunately I don't have the know-how to make them cooperate (sometimes DOH would work but not adblock, and vice versa). Would you kindly be able to assist me with this?

[genhen]

I am unable to set it up to work with mullvad

[cuentarealme]

I get like 6 google servers when running dnsleaktest. Is that ok? When picking cloud flare I only see one dns even when performing an extended test. Thanks for the video!

[extremedexterity]

Hi does the https-dns-proxy work with sqm? Im not able to test for bufferbloat

[LBUK.]

Custom rule no longer available in the firewall section

[bamskination]

Hi van! Do you have video how to create dns hijacking or interception? i followed the tutorial from openwrt doc but it seems doesn't work. dnsleak keeps detecting my custom pc dns not the router dns

[JC-gucf]

Thanks for this easy to follow DNS tutorial 😊

I have a wifi router with two radios. Do you have a tutorial on how to bridge the two wifi radios with the GUI?

[croaxzone]

after use this doh why my load balance error, wwan error 8

[williamhsantos]

Hello Van! Is the firewall rule necessary? Greetings from Brazil.

[otakumemenepal]

Can you tell me what's the point of doing this? Can't we simply put a custom DNS directly on the network interface settings?

[alexkhor]

passwall also got this function
can i ask war is this

[welliolima]

Hello, great class!!!
I'm trying to upload a gnix in openwrt. I'm having a lot of difficulties. Have you ever tried?

[KendyPCCorner]

Hello,
Thanks for the tutorial,
I was following step by step like on the video, but at the end i can't connect to the internet.

Hope u can help me bro.
Thanks a lot

[carves]

Is it possible to install Unbound with OpenWRT ? And will it works correctly ?

[GMCrelan]

make some SmartDNS tutorial please :D thank you

[rifemhere]

hello van, have you considered my suggestion regarding content on how to host files from openwrt?

[PutraKawasen]

Request ! install Tunnel Openwrt Trojan, Vmess, Wireguard, Shadowsock, etc. Please !!