I don’t run VPNs at the router level. The speed and latency hit, plus the spambot triggers aren’t worth it for me. This is purely a non-privacy minded preference, mind you, and I’m totally not an expert.

You bring up a good point though. Regardless of what’s running upstream, if my device is running private relay, it all gets bypassed. So I have to disable private relay.

My preference is to run nextdns over DoH, AdGuard locally on iOS + Stop the Madness, and a VPN when I’m feeling sheepish.

On iOS, I’ve tried quite a few combinations and I’ve gotten feedback from users with others.

When I ran pi-hole or AdGuard home, I also used AdGuard on all my iOS devices - both the DNS pseudo-VPN and safari extensions cause otherwise ads would sneak in. The Adguard app removes the annoying ads from Apple News and NYT apps.

Now I just use NextDNS and the same AdGuard iOS app setup.