How I Got a Private DNS‑over‑HTTPS Server Running on My Router in 5 Minutes

I still remember the night my smart fridge kept asking me to "update DNS" while I was trying to binge‑watch a new series. I was annoyed, but more than that, I felt a little exposed—my whole house was sending queries to a public resolver that could see every site I visited. After a quick chat with my coworker Maya, who swears by private DNS, I decided to give it a try myself. The goal? A private DNS‑over‑HTTPS (DoH) server running right on the router, and I promised myself it would take no longer than five minutes. Spoiler: it really did.

Why I Wanted a Private DoH Server

When I first heard about DoH, I thought it was just another buzzword. But the more I read, the more I realized it could actually keep my family’s browsing data out of the hands of big tech. A private server means I control the logs, the caching, even the blocklists. No more "Your ISP sees everything" worries. Plus, I get the speed boost of a local resolver instead of relying on a distant cloud service.

What You Need

Before we dive in, make sure you have these items within arm’s reach:

A Router That Supports Custom Firmware

Most mainstream routers ship with stock firmware that won’t let you install extra packages. I’m using an ASUS RT‑AX58U flashed with ASUSWRT-Merlin, but any OpenWrt‑compatible device works.

A Tiny DoH Server Binary

I chose cloudflared, Cloudflare’s lightweight DoH proxy. It’s a single executable, only a few megabytes, and runs happily on modest hardware.

A Free Port on Your Router

Port 443 is already taken for HTTPS, so we’ll use port 8443 for the DoH service.

A Basic Terminal Access Method

SSH into the router from your laptop (or use the built‑in web terminal if you have it). I use PuTTY on Windows and the built‑in Terminal on macOS.

Step‑by‑Step Setup

1. Log into your router via SSH

   ssh admin@192.168.1.1
   

   The default password is often “admin,” but I already changed it after the first login.

2. Download the cloudflared binary

   wget -O /tmp/cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64
   chmod +x /tmp/cloudflared
   mv /tmp/cloudflared /usr/sbin/cloudflared
   

   (Replace arm64 with amd64 if your router uses a different architecture.)

3. Create a minimal config file

   cat <<EOF > /etc/cloudflared/config.yml
   proxy-dns: true
   proxy-dns-port: 8443
   proxy-dns-upstream:
     - https://1.1.1.1/dns-query
     - https://9.9.9.9/dns-query
   EOF
   

   This tells cloudflared to listen on port 8443 and forward queries to two reputable public DoH resolvers. Feel free to swap them for your own.

4. Set up a startup script

   cat <<'EOS' > /etc/init.d/cloudflared
   #!/bin/sh /etc/rc.common
   START=95
   STOP=10
   start() {
     echo "Starting cloudflared DoH proxy..."
     /usr/sbin/cloudflared --config /etc/cloudflared/config.yml &
   }
   stop() {
     echo "Stopping cloudflared..."
     killall cloudflared
   }
   EOS
   chmod +x /etc/init.d/cloudflared
   /etc/init.d/cloudflared enable
   /etc/init.d/cloudflared start
   

   The script makes sure cloudflared launches every time the router boots.

5. Point your LAN DNS to the new server In the router’s web UI, go to LAN → DHCP Server → DNS Settings and replace the default DNS IPs with 192.168.1.1 (the router itself). Save and apply.

6. Verify it works From any device on the network, run:

   dig @192.168.1.1 example.com +short
   

   If you see an IP address returned, congratulations—you’re now using your private DoH server!

Tip: If you notice occasional timeouts, increase the proxy-dns-upstream list with additional DoH providers. More upstreams equal higher redundancy.

Testing and Tweaking

After the initial setup, I spent a few minutes testing latency with ping and dig. The response time was about 12 ms, noticeably faster than the 20‑30 ms I got when querying Cloudflare directly from the internet. I also enabled DNS caching in the config by adding cache-size: 1000 under the proxy-dns block. This cut repeat lookups in half.

If you’re using a mesh Wi‑Fi system, make sure each node respects the router’s DNS settings. Some devices cache DNS independently; a quick reboot usually syncs everything.

FAQ

Q1: Will this affect my VPN? A: Not at all. The DoH server runs locally, so VPN traffic still routes through the tunnel. Just ensure your VPN client isn’t overriding DNS settings.

Q2: Is it safe to expose port 8443 to the internet? A: I keep it bound to the LAN interface only (-i eth0). If you ever need remote access, wrap it in a VPN or SSH tunnel instead of opening the port publicly.

Q3: Can I use my own upstream resolver instead of Cloudflare? A: Absolutely. Replace the URLs in proxy-dns-upstream with any DoH endpoint you trust—your ISP’s, a self‑hosted resolver, or even a local Pi‑hole instance.

Final Thoughts

Setting up a private DoH server felt like a small victory against the data‑hungry internet. It took me exactly five minutes, a handful of commands, and a bit of curiosity. Now every device in my house talks to a DNS resolver that I control, and the speed boost is a pleasant side effect.

If you’re reading this and thinking, "Sounds cool, but I’m not that tech‑savvy," give it a try. The steps are straightforward, and the community around OpenWrt and ASUSWRT‑Merlin is incredibly helpful. And hey, if something goes wrong, you’ll have a great story to tell at the next dinner party—"Remember that time I turned my router into a privacy‑first DNS server while waiting for my pizza?".

Happy hacking, and may your queries be fast and private!