If your run a NAS on your network that has some extra horsepower, most of them can run containers now.

I run both pi-hole and my own DNS server inside my network as containers on the NAS. I then have my router configured to default to the pi-hole and then the DNS server.

Advantage of my own DNS server is it exclusively resolves using DNS-over-TLS so my queries are private.

Final fallback for resolution is 1.1.1.1 but based on logs my setup hasn’t hit the fallback.

I imagine you could also use a container to host VPN.

Most MIPS or ARM router CPUs are significantly underpowered to handle OpenVPN, and high-end routers are expensive now.

If you're intending to use OpenVPN, you could easily justify a basic x86 pfSense or linux router: https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...

Not just a dream, but a reality: https://www.pfsense.org/. (pfBlockerNg rather than pi-hole, but I think those are equivalent in functionality; someone correct me if I'm wrong)

You don't need to run pihole and VPN from your router. With port forwarding you can use your home lab to do both.