A WireGuard client, an OpenSnitch-inspired firewall and network monitor + a pi-hole-inspired DNS over HTTPS, DNS over TLS, DNSCrypt client with blocklists..

Firestack is a userspace TCP/UDP monitor, firewall, DNS resolver, and WireGuard client for Android. gVisor/netstack provides a SOCKS-like interface for TCP and UDP over a TUN device. Firestack supports DNS-over-HTTPS, DNS-over-TLS, Oblivious DNS-over-HTTPS, DNS over WireGuard / SOCKS5 / Tor, DNSCrypt, and plain old DNS upstreams.

Serverless DNS is a Pi-Hole esque content-blocking, serverless, stub DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) resolver. Runs out-of-the-box on Cloudflare Workers, Deno Deploy, Fastly Compute@Edge, and Fly.io. Free tiers of all these services should be enough to cover 10 to 20 devices worth of DNS traffic per month.