I second this. Very light, feature-rich, configurable and works flawlessly. I use it for ad blocking, proxying all DNS requests to DoT upstreams, and local addresses in LAN and over Wireguard.