DNS over HTTPS is gaining significant traction as a more secure and private method of browsing the internet. It works by sending DNS queries over HTTPS, ensuring they remain encrypted and protected from malicious actors. Implementing this solution requires setting up a proxy DNS resolver that supports this protocol, such as Cloudflare’s cloudflared. This post will guide you through the installation process of cloudflared on Ubiquiti Edge Router 4.

Compatibility Note (2026)

The build and installation story below is kept intact because it records the original EdgeRouter 4 setup. The sections before the current replacement describe the historical cloudflared proxy-dns method; Cloudflare removed that command in cloudflared 2026.2.0, so it no longer works with current releases. Cloudflare migration notice

Building cloudflared from Source

To get the latest version of cloudflared, you can build it from source with these steps:

git clone https://github.com/cloudflare/cloudflared.git
cd cloudflared
make cloudflared
go install github.com/cloudflare/cloudflared/cmd/cloudflared

If necessary, you can move cloudflared to a known path:

mv /root/cloudflared/cloudflared /usr/bin/cloudflared

Building cloudflared Binary for MIPS64 using Docker

If your host computer has Docker installed, you can compile cloudflared for the MIPS64 architecture by running the following Docker command in a new folder:

docker run --rm -v "$PWD":/usr/src/myapp -w /usr/src/myapp -e GOOS=linux -e GOARCH=mips64 golang bash -c "go get -v github.com/cloudflare/cloudflared/cmd/cloudflared; GOOS=linux GOARCH=mips64 go build -v -x github.com/cloudflare/cloudflared/cmd/cloudflared"

Installing cloudflared on the EdgeRouter

  1. Transfer the Binary: Copy over the cloudflared binary file to the EdgeRouter and move it to the correct location.

  2. Create a cloudflared User: Create a new user for cloudflared with no login shell:

sudo useradd -s /usr/sbin/nologin -r -M cloudflared
  1. Configure cloudflared: Edit the /etc/default/cloudflared configuration file by adding the following options to be passed to cloudflared at startup:
### Commandline args for cloudflared, using Cloudflare DNS
CLOUDFLARED_OPTS=--port 5053 --upstream https://1.1.1.1/dns-query --upstream https://1.0.0.1/dns-query --origincert /etc/cloudflared/cert.pem --no-autoupdate
  1. Update Permissions: Give the cloudflared user access to the configuration file and binary:
mkdir -v /usr/local/bin/
chmod +x cloudflared
mv cloudflared /usr/local/bin/
chown cloudflared:cloudflared /etc/default/cloudflared
chown cloudflared:cloudflared /usr/local/bin/cloudflared
mkdir /etc/cloudflared
/usr/bin/cloudflared service install
  1. Create a Systemd Service: Use a systemd service to automatically start cloudflared at boot:
[Unit]
Description=cloudflared DNS over HTTPS proxy
After=network.target

[Service]
TimeoutStartSec=0
Type=simple
User=cloudflared
EnvironmentFile=/etc/default/cloudflared
ExecStart=/usr/local/bin/cloudflared --config /etc/cloudflared/config.yml --origincert /etc/cloudflared/cert.pem --no-autoupdate
# ExecStart=/usr/local/bin/cloudflared proxy-dns $CLOUDFLARED_OPTS
Restart=on-failure
RestartSec=5s
KillMode=process

[Install]
WantedBy=multi-user.target
  1. Configure cloudflared: Add a config.yml file to /etc/cloudflared:
proxy-dns: true
proxy-dns-upstream:
 - https://1.1.1.1/dns-query
 - https://1.0.0.1/dns-query
proxy-dns-port: 5053
  1. Install the Default Init Script: Use cloudflared’s service installation command:
/usr/local/bin/cloudflared service install --legacy

As we are using mips64, disable auto update by replacing the cmd line in /etc/init.d/cloudflared.

  1. Start the cloudflared Service: Use the init script to start cloudflared:
/etc/init.d/cloudflared start
  1. Redirect DNS to cloudflared: Finally, configure your DNS settings to use cloudflared as the resolver:
configure
set service dns forwarding options "no-resolv"
set service dns forwarding options "server=127.0.0.1#5053"
commit
save
exit

With these steps completed, your Ubiquiti Edge Router 4 should now be using DNS over HTTPS, improving the security and privacy of your network.

Refer to the following sources for more information:

Current EdgeRouter Replacement: dnscrypt-proxy

dnscrypt-proxy publishes Linux/mips64 release archives and supports both DNSCrypt and DoH resolvers. It is the closest small replacement I have found for keeping the resolver directly on the ER4. dnscrypt-proxy releases and platforms and Cloudflare encrypted-DNS client guidance

Download a pinned release on a trusted workstation, verify the SHA-256 digest published with that GitHub release, then copy it to the router:

# Replace VERSION with a release that contains the linux_mips64 archive.
VERSION=2.x.y
ARCHIVE="dnscrypt-proxy-linux_mips64-${VERSION}.tar.gz"
curl -fLO "https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/${VERSION}/${ARCHIVE}"
DIGEST=$(curl -fsSL "https://api.github.com/repos/DNSCrypt/dnscrypt-proxy/releases/tags/${VERSION}" |
  jq -er --arg name "$ARCHIVE" '.assets[] | select(.name == $name) | .digest | sub("^sha256:"; "")')
printf '%s  %s\n' "$DIGEST" "$ARCHIVE" | sha256sum -c -
scp "$ARCHIVE" admin@router:/tmp/

On the router:

sudo useradd --system --home /var/lib/dnscrypt-proxy --shell /usr/sbin/nologin dnscrypt-proxy
sudo install -d -o dnscrypt-proxy -g dnscrypt-proxy /var/lib/dnscrypt-proxy
sudo install -d -m 755 /etc/dnscrypt-proxy
cd /tmp
tar -xzf dnscrypt-proxy-linux_mips64-*.tar.gz
sudo install -m 755 linux-mips64/dnscrypt-proxy /usr/local/bin/dnscrypt-proxy
sudo install -m 644 linux-mips64/example-dnscrypt-proxy.toml /etc/dnscrypt-proxy/dnscrypt-proxy.toml

I reduce /etc/dnscrypt-proxy/dnscrypt-proxy.toml to the settings I need:

server_names = ['cloudflare']
listen_addresses = ['127.0.0.1:5053']
ipv4_servers = true
ipv6_servers = false
dnscrypt_servers = true
doh_servers = true
require_dnssec = true
cache = true
[sources.public-resolvers]
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md']
cache_file = '/var/lib/dnscrypt-proxy/public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 73
prefix = ''

This source block matches the current example configuration, but I still compare its URL, Minisign key, and refresh interval with the example included in the exact release before installing it. dnscrypt-proxy example configuration

/etc/systemd/system/dnscrypt-proxy.service:

[Unit]
Description=Encrypted DNS proxy
After=network-online.target
Wants=network-online.target

[Service]
User=dnscrypt-proxy
Group=dnscrypt-proxy
WorkingDirectory=/var/lib/dnscrypt-proxy
ExecStart=/usr/local/bin/dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
Restart=on-failure

[Install]
WantedBy=multi-user.target

Validate and start it:

sudo /usr/local/bin/dnscrypt-proxy -check -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
sudo systemctl daemon-reload
sudo systemctl enable --now dnscrypt-proxy
dig @127.0.0.1 -p 5053 cloudflare.com
journalctl -u dnscrypt-proxy -b --no-pager

Only after that test succeeds do I point the EdgeRouter DNS forwarder at 127.0.0.1 port 5053.

Rollback

sudo systemctl disable --now dnscrypt-proxy
sudo systemctl revert dnscrypt-proxy 2>/dev/null || true

I then restore the router’s previous upstream resolver and remove the unit/binary only after DNS works again. The historical cloudflared design was sound for its time; the current replacement changes the resolver, not the purpose of the article.


Buy Me a Coffee