pfSense allows for an "out-of-the-box" ish gateway for most users, but it is a little overkill if your main concern is your ISP and their government de'jour snooping on your DNS traffic.
-
Get a router that is not your ISP router. Unless there is some rare chance they let you configure some other DNS. Even rarer chance it will be encrypted DNS.
-
Update your router firmware and check to see if it supports encrypted DNS. I updated my Asus mesh wifi a few months ago and was pleasantly surprised to see it supported forwarding to encrypted services and it works great.
-
Configure your end clients at the very least. Most modern browsers and even operating systems are starting to configure stand-alone encrypted DNS resolution. Five years ago this was a nightmare to setup. Today it's a breeze.
-
Huge recommend for Technitium, https://github.com/TechnitiumSoftware/DnsServer. Switched to this from pi-hole and never looking back. It focuses more on privacy, compatibility and security than block lists, but I found it to be way faster in my testing.
Thanks for coming to my TEDx.