found an old dnscrypt package for openwrt

probably doesn't work but is a start
gargoyle has a older and probably broken firewall utility

but we can try to get somewhere with it