[General Questions and Answers] Lusty Rugnuts:
Pro-Tip: Open Google Play Store, go to Settings, scroll down until you see the Play Store version. Press on it once to see if you've got the latest version (it'll install the latest version if you don't), and repeatedly press on it to enable Developer Options For Play Store... that'll let you get Pre-Release apps such as Nebulo, the open-source DNS-over-TLS-or-HTTPS app.

In Google Play Store, search for and install Nebulo. Set it up so that all your apps are forced to send their DNS requests through Nebulo. It'll set up a VPN server.

In AFWall+, enable Nebulo for WiFi and Cellular Data in whichever firewall profiles you wish. I've got it enabled in my "Default" and "Google-Enabled" profiles, whereas my "Lockdown" profile allows nothing in or out.

At the lower-right of Nebulo, you'll see a little icon that looks to me like three hard drives stacked together. Press it, and select whichever DNS protocol you want (DNS over TLS, or DNS over HTTPS). I selected DNS over HTTPS because this makes it nearly impossible for WiFi networks to hijack your DNS requests and route them through their own specified DNS servers.

Select the DNS server you want to use, or enter your own... I'll play with OpenNic DNS servers later, but for now, I enabled Quad9 DNS (dns.quad9.net).

Quad9 is a non-profit with a pretty good privacy policy. Being a non-profit, they have no financial incentive to collect, aggregate and sell your DNS history to make a buck. In fact, the legal infrastructure where they are forbids them doing so.

Further, they're a part of Global Cyber Alliance, which is dedicated to stopping cybercrime... they use IBM's X-Force database and other threat-analysis databases to block malicious websites.

Now open Brave Browser (I assume you've set it up so it automatically opens either DuckDuckGo.com or StartPage.com, yes?) and search for "What's my DNS server?".

One of the results will be What's My DNS Server?, open that page, press the "What's my DNS Server?" button, and it should tell you (assuming you used Quad9 like I did) the IP address and owner of the DNS server.

In my case, it shows 74.63.16.250, WoodyNet, which is part of Quad9 (their DNS servers being AnyCast servers). AnyCast DNS routes DNS queries to the nearest DNS server in their domain to improve performance. Quad9, however, doesn't own its own DNS servers, it relies upon Packet Clearing House (Bill Woodcock) to host servers for it. That's why you see "WoodyNet"... the DNS servers are under control of Quad9, but they're hosted on Bill Woodcock's physical servers.

Now you can go into AFWall+ and either delete or comment out the DNS portion of the IPTables scripts.

{UPDATE}

Found a bug / feature in Nebulo... right when you enable the network interface, Nebulo sets a dummy IP address before it can get the interface's IP address... it sets 8.8.8.8, a DNS server owned by Google, likely because that's what most people have in their resolv.conf as their default DNS server.

But I had 8.8.8.8 (in fact, every single IP address owned by Google) blocked in my AFWall+ firewall's 'Default' profile, so Nebulo never got any traffic. Commenting out the iptables entry blocking 8.8.8.8 got Nebulo working. I've got a feature request in with the Nebulo developers to allow the user to set their own dummy IP address, or to use a non-Google IP address.

{/UPDATE}

{UPDATE2}

The developer for Nebulo has changed the code so it sets a different dummy IP address. So now if you're like me, you can block all of Google's CIDR ranges and still have Nebulo work.

{/UPDATE2}