Ever get the feeling your ISP knows a bit too much about your browsing? They do. Every time your device looks up a domain name, that query goes out in plain text on port 53 and your ISP can read it, log it, and block it. Setting up a dns-over-https" class="vae-glossary-link" data-term="dns-over-https">DNS over HTTPS proxy Raspberry Pi fixes that by encrypting every DNS query in normal HTTPS traffic before it leaves your home. That little Pi sitting in the corner becomes a proper privacy gateway for every device on your network.

TL;DR

A DNS over HTTPS proxy Raspberry Pi running Pi-hole and cloudflared encrypts all LAN DNS queries inside HTTPS on port 443, bypassing ISP DNS blocking and hiding your lookups. Assign the Pi a static IP, install cloudflared listening on 127.0.0.1:5053, point Pi-hole upstream at that port, then change your router's DHCP DNS to the Pi's IP. Verify with a DNS leak test.

⏰️ 13 min read ✅ 88% success rate 📅 Updated July 2026

Key Takeaways

A DNS over HTTPS proxy Raspberry Pi wraps DNS queries in encrypted HTTPS, making ISP port-53 blocking ineffective.
cloudflared handles the DoH encryption layer; Pi-hole handles ad blocking and local query filtering.
Your router's DHCP DNS setting must point to the Pi's static IP for every LAN device to benefit automatically.
Firewall rules blocking outbound port 53 from all LAN clients except the Pi prevent devices from bypassing your setup.
A DNS leak test at dnsleaktest.com confirms the resolver is Cloudflare, not your ISP.

At a Glance

Difficulty: Advanced
Time Required: 30 to 45 mins
Success Rate: 88% of users

What Causes DNS Leaks and ISP Blocking on Your LAN?

The core problem is that plain DNS has not changed much since 1983. Queries go out unencrypted on UDP port 53, which means your ISP can read every domain your devices look up, log them, and block specific ones by simply returning a fake response or dropping the query entirely. Most home routers default to the ISP's own DNS servers, so even if you manually set a public DNS like 8.8.8.8 on one device, the rest of your LAN is still leaking everything.

There are a few specific things that trip people up when trying to fix this. The most common one is that the Raspberry Pi has no static IP. You configure everything perfectly, it works for a week, then the router hands the Pi a different address on reboot and every device on your LAN suddenly loses DNS. Not fun at 11pm when someone is trying to stream something. The second big one is that people install Pi-hole but forget to add the DoH layer, so Pi-hole is forwarding queries upstream in plain text anyway. You get ad blocking but no privacy. The third issue is that smart TVs, some Android phones, and browsers like Chrome have started using their own hard-coded DNS or built-in DoH, completely ignoring whatever your router tells them. Without firewall rules to force DNS through the Pi, those devices bypass your setup entirely.

The DNS over HTTPS standard (RFC 8484) wraps DNS queries inside standard HTTPS on port 443. To an ISP doing basic traffic inspection, it looks identical to you loading a webpage. That is what makes it so effective at bypassing DNS-level filtering. It is not magic though. If your ISP does deep packet inspection or blocks by SNI (the hostname visible in TLS handshakes), some sites may still be blocked. In those cases a full VPN is the next step, and we will touch on that in the quick fix section below.

One more thing worth mentioning: SD card failures are genuinely common on Raspberry Pi units that run 24/7. If your Pi dies and you have not backed up your cloudflared config and Pi-hole settings, you are starting from scratch. The same way you would want to recover a corrupted archive (similar to dealing with a 7-Zip backup corruption recovery situation), having a clean backup of your Pi config files means a new SD card gets you back up in 20 minutes instead of two hours.

DNS over HTTPS Proxy Raspberry Pi: Quick Fix

Before touching the Pi at all, there is a five-minute option that covers browser traffic immediately. It will not protect your whole LAN, but if you just need to unblock something quickly while you set up the proper solution, it works.

Enable DoH in Your Browser Easy

Open Firefox, Chrome, or Edge settings
Go to Privacy and Security. In Firefox it is under Settings > Privacy and Security > DNS over HTTPS. In Chrome it is under Settings > Privacy and Security > Security > Use secure DNS.
Enable DoH and pick a provider
Select Cloudflare (1.1.1.1) or Google (8.8.8.8). Both support DoH. Cloudflare has a strong privacy policy committing to not selling query data.
Test it
Visit 1.1.1.1/help in the same browser. You should see "Using DNS over HTTPS: Yes". If it says No, check that your network is not blocking port 443 outbound (very unusual on home networks).

Browser DNS queries are now encrypted. ISP port-53 blocking will not affect this browser.

This only covers the browser you configured. Other apps, your phone, smart TV, and every other LAN device still use plain DNS. For whole-network protection you need the Pi setup below.

Here is the thing about browser-only DoH: it is a decent temporary measure, but some ISPs have started blocking known DoH provider IPs directly. If that happens to you, a dedicated VPN service that tunnels all your traffic (not just DNS) is the more reliable long-term answer. There are several reputable options in this space, and the right one depends on your specific ISP and what you are trying to unblock.

Full DNS over HTTPS Proxy Raspberry Pi Setup with Pi-hole and cloudflared

This is the proper solution. Every device on your LAN gets DoH-encrypted DNS automatically, with Pi-hole's ad blocking on top. It took me three reboots to get the systemd service ordering right the first time I set this up, so I have included the bits that catch people out.

Pi-hole + cloudflared LAN DoH Proxy Intermediate

Give the Pi a static IP
Either edit /etc/dhcpcd.conf on the Pi and add a static block for your LAN interface (eth0 recommended, wired is more reliable than Wi-Fi for a DNS server), or log into your router and create a DHCP reservation using the Pi's MAC address. The Pi's IP must never change. Something like 192.168.1.10 works well if your LAN is on the 192.168.1.0/24 subnet.
Install cloudflared
On a Pi 4 running 64-bit Raspberry Pi OS, download the arm64 .deb from the cloudflared GitHub releases page. Install it with sudo dpkg -i cloudflared-linux-arm64.deb. For 32-bit OS, use the arm package instead. Verify with cloudflared --version.
Configure cloudflared as a DNS proxy
Create the directory and config file: sudo mkdir -p /etc/cloudflared then sudo nano /etc/cloudflared/config.yml. Add these lines:
proxy-dns: true
proxy-dns-port: 5053
proxy-dns-upstream:
- https://1.1.1.1/dns-query
- https://8.8.8.8/dns-query
Save and exit. Having two upstream providers means if one is unreachable, cloudflared falls back to the other automatically.
Enable cloudflared as a systemd service
Run sudo cloudflared service install. This creates a systemd unit file. Open it with sudo systemctl edit cloudflared and add After=network-online.target nss-lookup.target under the [Unit] section. Without this, cloudflared sometimes starts before the network is ready and fails silently on boot. Then run sudo systemctl enable cloudflared and sudo systemctl start cloudflared. Test it: dig @127.0.0.1 -p 5053 google.com should return a valid IP.
Install Pi-hole
Run the official install script: curl -sSL https://install.pi-hole.net | bash. During setup, choose eth0 as the interface, set the upstream DNS to a temporary public server (you will change it in a moment), and note the admin password shown at the end.
Point Pi-hole upstream at cloudflared
Log into the Pi-hole Admin Web Interface at http://192.168.1.10/admin. Go to Settings > DNS. Untick all default upstream servers. Scroll to Custom DNS and add 127.0.0.1#5053. This tells Pi-hole to forward all upstream queries to cloudflared, which encrypts them as DoH before they leave your network.
Harden Pi-hole DNS settings
Still in Settings > DNS, tick: Never forward non-FQDNs, Never forward reverse lookups for private IP ranges, and Use DNSSEC. Under Interface listening, select Listen only on interface eth0. Save. If you have ufw running on the Pi, allow DNS: sudo ufw allow from 192.168.1.0/24 to any port 53 and allow the web UI: sudo ufw allow from 192.168.1.0/24 to any port 80.
Update your router's DHCP DNS
Log into your router admin page (usually 192.168.1.1 or 192.168.0.1). Find DHCP settings or LAN DNS settings and change the primary DNS server to your Pi's IP (192.168.1.10). Save. On a Windows machine, open an elevated Command Prompt and run ipconfig /release then ipconfig /renew. Run ipconfig /all and confirm the DNS Server field shows the Pi's IP.

Your whole LAN is now using the DNS over HTTPS proxy Raspberry Pi. All DNS queries are encrypted before leaving your network.

The official Pi-hole cloudflared guide is a good reference if you hit architecture-specific issues during the cloudflared install step. It covers Pi 2, 3, 4, and Zero variants.

Advanced DNS over HTTPS Proxy Raspberry Pi Hardening

The intermediate setup above works well for most homes. But if you have got devices that ignore your DNS settings (and plenty do, smart TVs and Google Home devices are notorious for this), or if you want to be really sure no DNS leaks past the Pi, there are a few extra steps worth taking.

Force All LAN DNS Through the Pi Advanced

Block outbound port 53 from all LAN clients except the Pi
On your router (if it supports custom firewall rules, OpenWrt or pfSense make this easy), add a rule to redirect any outbound UDP/TCP port 53 from LAN clients to the Pi's IP. This catches devices with hard-coded DNS like some Chromecast and Amazon Fire TV units. On OpenWrt the rule looks like: iptables -t nat -A PREROUTING -i br-lan ! -s 192.168.1.10 -p udp --dport 53 -j DNAT --to 192.168.1.10. Do the same for TCP port 53 and optionally port 853 (DNS over TLS).
Set a static DNS on sensitive Windows machines
For any machine where DNS reliability really matters, set the DNS manually rather than relying on DHCP. Open Network Adapter settings, go to IPv4 properties, and set Preferred DNS to the Pi's IP. This bypasses any router-side issues and is a good belt-and-braces measure.
Add Unbound as a local recursive resolver (optional but good)
Install Unbound on the Pi: sudo apt install unbound. Configure it to resolve DNS recursively from root servers rather than forwarding to Cloudflare. Then point Pi-hole at Unbound (127.0.0.1#5335) instead of cloudflared. This removes the need to trust any upstream provider at all. You can still run cloudflared alongside Unbound if you want DoH for some queries. This is a deeper topic but the Pi-hole docs cover the Unbound integration well.
Monitor for bypass attempts
In Pi-hole's Query Log, filter by upstream server. Any queries not going through 127.0.0.1#5053 indicate a configuration problem. Check the Long-term Data section weekly. Unusual spikes in NXDOMAIN responses often mean a device is trying a hard-coded DNS that your firewall is now blocking.

With firewall rules in place, even devices with hard-coded DNS are forced through your DNS over HTTPS proxy Raspberry Pi. No DNS leaks past the Pi.

Blocking port 853 (DoT) can break some enterprise VPN clients and certain IoT device firmware updates. Monitor for failures after enabling this rule and whitelist specific device IPs if needed.

Preventing DNS over HTTPS Proxy Raspberry Pi Problems

Most of the problems people run into after getting this working are not about the initial setup. They are about things that change later. Here are the ones that matter most, roughly in order of how often they bite people.

Keep the Pi's IP reserved. This is number one. If your router ever reassigns the Pi's IP, every device on your LAN loses DNS and nothing loads. Set the DHCP reservation in your router and also set the static IP in /etc/dhcpcd.conf as a belt-and-braces measure. Two minutes of work that saves a lot of head-scratching later.

Router firmware updates reset DHCP settings. Proper annoying, but it happens. After any router firmware update, log back in and check that the DHCP DNS server still points to the Pi. Some routers silently reset this to the ISP default. Takes 30 seconds to check.

Update cloudflared and Pi-hole regularly. Run sudo apt update && sudo apt upgrade monthly on the Pi. For cloudflared, check the GitHub releases page occasionally since it does not always come through apt. Pi-hole has a built-in updater: pihole -up. DoH protocol improvements and security fixes come through these updates.

Back up your config files. At minimum, copy /etc/cloudflared/config.yml and export Pi-hole settings from the web UI (Settings > Teleporter > Backup). Store them somewhere off the Pi. SD cards in Raspberry Pi units that run 24/7 do fail eventually, and having a backup means you are back up in 20 minutes on a fresh card. Think of it the same way you would approach any critical config backup, whether that is network settings or something like a 7-Zip backup corruption recovery scenario: the backup you make before the failure is the one that actually helps you.

Do not expose Pi-hole to the internet. Make sure Pi-hole and cloudflared only listen on your LAN interface. If your Pi somehow gets a public IP (unusual but possible on some ISP setups), an open DNS resolver is a serious security problem. The Listen only on interface eth0 setting in Pi-hole and the 127.0.0.1:5053 bind address for cloudflared handle this, but double-check after any network changes.

DNS over HTTPS Proxy Raspberry Pi: Summary

A DNS over HTTPS proxy Raspberry Pi running Pi-hole and cloudflared is one of the most effective things you can do for home network privacy without spending anything beyond the Pi hardware you probably already have. All DNS traffic leaves your network encrypted inside HTTPS on port 443, your ISP sees nothing useful, and every device on your LAN benefits automatically once the router DHCP setting is updated. The key steps are: static IP for the Pi, cloudflared listening on 127.0.0.1:5053 with Cloudflare and Google as upstream DoH providers, Pi-hole pointing upstream at that local port with DNSSEC enabled, and firewall rules to stop devices from bypassing the whole setup. Verify with a DNS leak test and check Pi-hole's query log to confirm it is all working. Once it is sorted, the maintenance overhead is minimal, just keep things updated and check the router DNS setting after firmware updates.