Putting Cloudflare Gateway on Your Home Network

Cloudflare Gateway’s DNS filtering can block malware, phishing, and ransomware before they reach your devices. While the service is often pitched at corporate teams, it works just as well for a home setup. The key is figuring out where to enforce the filtering: inside a single browser, across an entire laptop, or at the router for every connected device. The right model depends on how much control you need and how much setup you want to take on.

DNS itself is a plaintext protocol. Every query you send to resolve a hostname like www.cloudflare.com is visible to anything between your client and the DNS server. DNS over HTTPS (DoH) wraps those queries in the same encryption used for web traffic, so only the DNS server you choose can see what you are asking. Gateway matches incoming DNS queries to your configuration using a three-step lookup order:

  1. A DNS over HTTPS check based on your unique hostname
  2. An IPv4 check based on source address
  3. A lookup based on the IPv6 destination address

Whichever method you pick, the first stop is https://dash.teams.cloudflare.com. Sign-up takes a few minutes, and after you configure your first location you receive a unique DoH endpoint and destination IPv6 address. The DoH hostname is the one you will need later.

Browser-Level DoH

Enabling DoH in a browser is the quickest path, but it only secures queries that browser makes. Other devices on your network—phones, smart TVs, game consoles—still use whatever DNS your ISP assigned.

Chromium-based browsers such as Chrome have a straightforward toggle under chrome://flags, but they do not support custom DoH servers. You can encrypt your queries, just not with Gateway. Firefox is the exception: it supports both DoH and custom server entries. In Firefox, go to Preferences → General → Network Security, choose Settings, then select “Enable DNS over HTTPS,” pick “Custom,” and paste your Gateway DoH address. Optionally, you can enable Encrypted SNI (ESNI) by setting network.security.esni.enabled to true in about:config.

Router-Level Deployment with Pi-hole

Securing your whole network requires a DNS server on your LAN. Consumer routers rarely support custom DoH servers out of the box. Even popular custom firmwares like dd-wrt and open-wrt support DoH but not custom servers. What most routers do support is DHCP forwarding, which lets you offload DNS and DHCP to another device. A Raspberry Pi running Pi-hole is a natural fit.

Before installing anything, give the Pi a static IP on your router’s subnet. Edit /etc/dhcpcd.conf, restart the service with sudo /etc/init.d/dhcpcd restart, and confirm with ip addr show dev eth0. Then install Pi-hole from its one-step automated installer at https://github.com/pi-hole/pi-hole/.

Pi-hole will forward queries to a local dnscrypt-proxy instance, which in turn speaks DoH to Gateway. Grab the latest dnscrypt-proxy release for ARM and install it:

wget https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/2.0.39/dnscrypt-proxy-linux_arm-2.0.39.tar.gz
tar -xf dnscrypt-proxy-linux_arm-2.0.39.tar.gz
mv linux-arm dnscrypt-proxy
cd dnscrypt-proxy
cp example-dnscrypt-proxy.toml dnscrypt-proxy.toml

Next, generate a DoH stamp using the dnscrypt stamp tool, encoding your Gateway DoH address. In dnscrypt-proxy.toml, uncomment the lines under [static], rename the section to [static.'gateway'], and replace the default stamp with your generated one. Also update these settings:

  • server_names = ['gateway']
  • listen_addresses = ['127.0.0.1:5054']
  • fallback_resolvers = ['1.1.1.1:53', '1.0.0.1:53']
  • cache = false

Install dnscrypt-proxy as a service with sudo ./dnscrypt-proxy -service install, then start it with sudo ./dnscrypt-proxy -service start. Verify it is listening on 5054 using sudo service dnscrypt-proxy status or netstat -an | grep 5054. You can also test the upstream path directly:

dig www.cloudflare.com -p 5054 @127.0.0.1

If you see the matching request in the Gateway query log, the chain is working.

Pointing Pi-hole at dnscrypt-proxy

Pi-hole’s server may run localhost by default. To route all queries through Gateway, you need a few extra setup steps. Pi-hole’s default configuration forwards to a public DNS resolver, so you must change the upstream. In the Pi-hole admin console, go to Settings → DNS and set the upstream server to 127.0.0.1#5054. Note that Pi-hole picks the fastest upstream, so if you want redundancy it has to be in the dnscrypt-proxy configuration, not at the Pi-hole layer.

Before switching your network over, enable Pi-hole’s DHCP server in Settings → DHCP. The cleanest deployment is to have Pi-hole handle both DNS and DHCP. Routers tend to behave oddly if you outsource DNS but not DHCP.

Finally, set your router to DHCP forwarding and point it at the Pi-hole’s static address. After applying the router config, disconnect and reconnect to the network. If everything is correct, you will receive a new IPv4 address from the Pi-hole DHCP server, and your DNS server will be the Pi-hole’s IP. From there, the Gateway policy editor is where you actually define the blocking rules.

Other Lookup Methods

DoH is the cleanest approach, but Gateway also supports two address-based matching methods. The simplest requires a static IPv4 address on your network. If your residential connection uses dynamic IPs—which change whenever the router restarts—this method will not stay reliable. The IPv6 option involves pointing your local DNS server at the unique destination IPv6 address Cloudflare gives you for your location. That works, but only if your router and ISP handle IPv6; otherwise DNS resolution simply fails.

Which Setup Fits?

Per-browser DoH is fine for a single laptop, but it leaks queries from everything else on the network. A Raspberry Pi running Pi-hole and dnscrypt-proxy adds some moving parts, yet it is the only approach here that filters every device at the router without flashing firmware or paying for a static IPv4 address. Given the current state of consumer router support for custom DoH servers, the Pi-hole path remains the most practical way to get Gateway across an entire home network.