OpenWrt: forward all LAN DNS to dnsdome

Option 1: plain DNS through dnsmasq

The simplest setup. The router's public IP identifies your profile, so add it to the allowlist in the panel first.

1. In LuCI open Network → Interfaces → WAN → Edit → Advanced Settings. Untick Use DNS servers advertised by peer and enter 87.244.198.165 under Use custom DNS servers. Do the same on WAN6 if present.
2. Open Network → DHCP and DNS → Forwards (older releases: General Settings → DNS forwardings) and add 87.244.198.165.
3. Save & Apply, then on the router:

   /etc/init.d/dnsmasq restart
   nslookup doubleclick.net 127.0.0.1

Or from SSH:

uci set network.wan.peerdns='0'
uci set network.wan.dns='87.244.198.165'
uci add_list dhcp.@dnsmasq[0].server='87.244.198.165'
uci commit && /etc/init.d/network restart && /etc/init.d/dnsmasq restart

Option 2: DNS-over-HTTPS with https-dns-proxy

With DoH the token identifies your profile, so a dynamic WAN IP is no problem, and your upstream queries are encrypted. Copy the DoH URL from the profile's Encrypted DNS card.

1. Install the package and its LuCI app:

   opkg update
   opkg install https-dns-proxy luci-app-https-dns-proxy

2. Open Services → DNS HTTPS Proxy. Delete the default providers and add a Custom entry with resolver URL https://dns.dnsdome.com/dns-query/<token> and bootstrap DNS 87.244.198.165.
3. Leave Update DNSMASQ Config on Start/Stop enabled. The package then rewrites dnsmasq's forwards to the local proxy on 127.0.0.1#5053 automatically.
4. Save & Apply, then check:

   /etc/init.d/https-dns-proxy restart
   logread | grep https-dns-proxy | tail
   nslookup doubleclick.net 127.0.0.1

Stop devices going around the router

Redirect every LAN DNS query to the router, so a TV with 8.8.8.8 baked in still gets filtered. In Network → Firewall → Port Forwards add a rule, or from SSH:

uci add firewall redirect
uci set firewall.@redirect[-1].name='Force DNS'
uci set firewall.@redirect[-1].src='lan'
uci set firewall.@redirect[-1].proto='tcp udp'
uci set firewall.@redirect[-1].src_dport='53'
uci set firewall.@redirect[-1].dest_port='53'
uci set firewall.@redirect[-1].target='DNAT'
uci commit firewall && /etc/init.d/firewall restart

To also block third-party DNS-over-TLS, add a traffic rule rejecting LAN to WAN on TCP port 853.

Verify from a client

nslookup doubleclick.net on any LAN device should return the block response with Ads & Tracking enabled, and the query appears in the panel's log within a minute. If lookups fail entirely with option 1, the router's public IP is not on the allowlist.