How to Change DNS on a Huawei Router in 2026

Changing the DNS servers on a Huawei router takes effect for every device on your network at once — no per-device configuration needed. Whether you are switching to Cloudflare (1.1.1.1), Google (8.8.8.8), or Quad9 (9.9.9.9), the process trips people up because Huawei's admin interface went through two major design generations, and the DNS setting you actually need sits in a different place than most guides describe. This article covers every Huawei router variant sold between 2018 and 2026, from the AX and BE home series to 4G mobile routers and ISP-supplied ONTs.

The two DNS settings on a Huawei router

Before touching anything, understand that Huawei routers expose DNS in two completely separate places, and confusing them wastes hours:

• WAN DNS (upstream resolver) — the server the router itself uses for its own lookups: firmware update checks, NTP, cloud sync. Changing this does not affect what your phones and laptops use.
• DHCP DNS — the resolver the router broadcasts to every client when it assigns an IP address via DHCP option 6. This is the setting you almost certainly want to change.

If you only update the WAN DNS field, every device on the LAN continues using the ISP resolver until its DHCP lease expires — typically 24 hours — or until you force a manual renewal. This is the most common reason a Huawei DNS change appears to do nothing.

Find your Huawei router admin page

Huawei routers ship with one of four default gateway IPs depending on the product line:

• 192.168.3.1 — AX3, AX3 Pro, AX6, AX6 Pro, BE3 Pro, BE6, WiFi 6 SE, WiFi 7 Pro, and most routers sold 2020–2026.
• 192.168.8.1 — 4G and 5G mobile routers: B310, B525, B618, B715, B535.
• 192.168.1.1 — older HG-series units and early B-series devices from before 2018.
• 192.168.100.1 — ISP-supplied optical network terminals (ONTs) such as the HG8145V5 and HG8245Q2. DNS fields on these are often locked by the ISP; see the bridge mode section below.

If none of those load, find your actual gateway first:

Method 1: Web UI on modern firmware (AX, BE, WiFi 6 and 7 series)

This covers routers running firmware 20.9 or later — the redesigned panel rolled out across the AX and BE lines from 2021 onward. Open a browser and navigate to http://192.168.3.1. Use HTTP, not HTTPS; the self-signed TLS certificate triggers a blocking error in Chrome and Edge on these devices.

1. Log in. Credentials are printed on the label underneath the router. Since 2019 firmware, Huawei no longer ships a universal default password — it is always device-specific.
2. Click More in the top navigation bar.
3. If the page opens in a simplified Home view, click Switch to Advanced in the top-right corner.
4. Navigate to Advanced > DHCP Server.
5. In the LAN interface section, locate Primary DNS Server and Secondary DNS Server.
6. Clear the existing ISP values and enter your preferred resolver. For Cloudflare: Primary 1.1.1.1, Secondary 1.0.0.1. For Google: Primary 8.8.8.8, Secondary 8.8.4.4.
7. Click Save.
8. Force a DHCP lease renewal on each device so they receive the new DNS immediately rather than waiting for lease expiry.

On some firmware builds the navigation path differs slightly: Basic > LAN Settings > DHCP Settings. If DHCP Server does not appear under Advanced, check Basic first before assuming your firmware doesn't support the setting.

Method 2: HiLink and AI Life app (Android and iOS)

If the router was first configured through the Huawei AI Life or HiLink app and you never set a separate web-admin password, the app may be the only available management route.

1. Connect your phone to the router's Wi-Fi.
2. Open Huawei AI Life or HiLink.
3. Tap the router icon on the Home screen, then tap Router Settings.
4. Tap More Functions > Advanced Settings.
5. Scroll to DHCP and tap it.
6. Update the Primary DNS and Secondary DNS fields, then tap Save.

If DHCP is not visible under Advanced Settings, look under LAN Settings in the same menu. App-based changes are applied immediately; client devices receive the new resolver at the next DHCP renewal or on Wi-Fi reconnect.

Method 3: Mobile router web UI (B310, B525, B618, B715, B535)

Huawei's 4G and 5G mobile home routers use a separate admin interface at http://192.168.8.1. Default credentials on older units are admin / admin; newer units print a device-specific password on the label.

1. Click Settings in the top navigation bar.
2. Go to Settings > DHCP and set the Primary DNS and Secondary DNS fields. These are the resolvers pushed to clients over DHCP.
3. To also change the resolver the router uses for its own WAN-side queries, go to Settings > Dial-up > DNS and set the preferred and alternate DNS there.
4. Save both sections, then reconnect clients.

Method 4: SSH and command line (advanced)

Consumer Huawei routers do not ship with SSH enabled, but some enterprise-adjacent models and developer builds support shell access. With a shell session, DHCP DNS is typically managed by dnsmasq:

Always back up dnsmasq.conf before editing. A malformed config file breaks DHCP for every device on the LAN until you reboot the router or restore the backup.

Which DNS servers to use in 2026

The right resolver depends on what you are optimizing for:

• Speed and reliability: Cloudflare 1.1.1.1 / 1.0.0.1. Consistently lowest median response latency in independent global benchmarks. Supports DoH and DoT natively.
• Maximum compatibility: Google 8.8.8.8 / 8.8.4.4. Rock-solid uptime with no known ISP compatibility issues. Full documentation at developers.google.com/speed/public-dns.
• Threat blocking: Quad9 9.9.9.9 / 149.112.112.112. Blocks domains flagged by aggregated threat-intelligence feeds. DNSSEC-validating by default.
• Free parental controls: OpenDNS FamilyShield 208.67.222.123 / 208.67.220.123. No account required to start blocking adult content categories.
• Granular per-device control: NextDNS or ControlD — each account provides a unique resolver endpoint with per-client query logs, custom block lists, and analytics dashboards.

IPv6 note: if your ISP provides IPv6 connectivity — standard for most major providers in 2026 — set the IPv6 DNS fields as well. Navigate to Advanced > IPv6 > DHCPv6 and enter primary and secondary IPv6 DNS addresses. Cloudflare's IPv6 addresses are 2606:4700:4700::1111 and 2606:4700:4700::1001; Google's are 2001:4860:4860::8888 and 2001:4860:4860::8844. Skipping the IPv6 DNS while setting only IPv4 means dual-stack clients bypass your chosen resolver for all AAAA record queries.

Verify the change worked

Do not assume the save took effect. Test from a device on your LAN immediately after forcing a lease renewal:

Force a DHCP lease renewal so you do not have to wait for expiry:

If ipconfig /all still shows old DNS values after renewal, flush the OS DNS cache before retesting:

Run a live lookup with the DNS Lookup tool and compare the result against a direct authoritative query — a fast way to confirm the resolver path without installing additional utilities.

How the change propagates across operating systems

The Huawei DHCP DNS update reaches devices at different speeds depending on their OS, which creates the impression the change worked on some devices but not others.

Windows 10 and 11 pick up the new DNS on reconnect or lease renewal but maintain an aggressive local cache — up to 86,400 seconds for negative responses. Always run ipconfig /flushdns after renewing the lease. Domain-joined machines are a special case: the Active Directory domain controller's DNS overrides DHCP-assigned resolvers for all domain-suffix queries regardless of router configuration.

macOS Sequoia and Sonoma pick up DHCP DNS on reconnect but the mDNSResponder cache persists independently. Flush it with sudo dscacheutil -flushcache followed by sudo killall -HUP mDNSResponder before retesting. macOS also fails over to the secondary DNS rapidly on timeout, so a slow primary will shift traffic to secondary within a few seconds.

Linux with systemd-resolved (Ubuntu 22.04+, Fedora 36+, Debian 12+) feeds the DHCP-assigned resolver into a per-link configuration, visible via resolvectl dns. If a manual /etc/resolv.conf pointing to a different server exists, it overrides DHCP entirely. If the change has no visible effect on Linux, check whether resolv.conf is managed by a separate tool such as resolvconf or openresolv.

Android 9 and later supports Private DNS (DNS-over-TLS) under Settings > Network > Advanced > Private DNS, which overrides DHCP DNS for all apps on the device. If Private DNS is set to a specific hostname on the Android handset, your router DHCP setting is ignored for that device regardless of what is broadcast.

iOS 14 and later respects DHCP DNS unless a per-network manual DNS override exists under Settings > Wi-Fi > tap the network > Configure DNS > Manual. iOS 17 added support for encrypted DNS configuration profiles — deployable via MDM or as downloadable .mobileconfig files — which also take precedence over DHCP DNS when installed.

Common reasons the change does not take effect

Wrong DNS field changed. Editing the WAN DNS field instead of DHCP Server is the single most common mistake. Confirm the edit was made under Advanced > DHCP Server, not under the WAN interface, PPPoE settings, or IPv6 WAN.

Stale DHCP lease. A device with a 24-hour lease issued 23 hours ago won't receive new DHCP parameters for another hour unless you force a renewal. Always renew immediately after changing the setting.

Browser DoH overriding system DNS. Firefox uses Cloudflare DoH by default regardless of OS or router DNS settings. Chrome's Secure DNS feature can redirect queries independently. If a filtering resolver is not blocking expected domains after the router change, inspect browser encrypted DNS settings before blaming the router.

ISP transparent DNS proxy. Some ISPs silently intercept all outbound UDP and TCP port 53 traffic and redirect it to their own resolver. Symptom: nslookup always reports the ISP resolver no matter what is configured locally. Fix: use DNS-over-TLS or DNS-over-HTTPS so queries are encrypted and cannot be transparently redirected — see the encrypted DNS section.

Hardcoded static IP devices. Printers, NAS units, IP cameras, and servers configured with a static IP never receive DHCP parameters. Update their DNS settings manually in each device's own network configuration.

Firmware update reset the setting. Huawei firmware updates occasionally restore factory DNS defaults. Open Advanced > DHCP Server immediately after any firmware upgrade and confirm your DNS values are still present.

Encrypted DNS on Huawei routers in 2026 (DoT and DNSSEC)

Huawei firmware version 21.x and later — visible at System > About > Firmware Version on the AX6 Pro, AX6, BE3 Pro, and BE6 — added DNS-over-TLS forwarding under Advanced > Security > Encrypted DNS. When enabled, the router tunnels all forwarded DNS queries over TLS port 853 to the configured upstream hostname. Cloudflare's DoT hostname is 1dot1dot1dot1.cloudflare-dns.com; Google's is dns.google. DNSSEC validation is handled by the upstream resolver rather than the Huawei firmware itself.

Models on older firmware without the Encrypted DNS option can achieve equivalent privacy by running AdGuard Home or Pi-hole on a device on the LAN, configuring its upstream to use a DoH or DoT provider, and pointing the Huawei router's DHCP DNS to that local instance's IP address. This adds one LAN hop but works across every Huawei firmware version and provides per-client query logs and custom block lists as a bonus.

ISP-locked ONTs and bridge mode

If your Huawei device is an ISP-provided ONT — HG8145V5, HG8245Q2, EG8145V5 — in router mode, the ISP typically locks or removes the DNS configuration fields and restricts the admin account to a limited role. Three practical options:

1. Request bridge or PPPoE pass-through mode from your ISP. The ONT then acts as a pure layer-2 pass-through and a downstream router you control handles DHCP, DNS, and routing. This is the cleanest long-term fix.
2. Locate the full admin interface. Some ISPs leave the complete admin UI accessible at 192.168.100.1 with a super-admin account whose credentials vary by provider and country. Search for your specific ISP name and ONT model number to find documented access methods.
3. Override DNS at each client individually. If the ONT cannot be changed, configure DNS manually in each device's network settings rather than relying on the locked DHCP broadcast.

Prevent DNS settings from reverting

1. Back up the router config immediately after confirming the change. Navigate to Advanced > System > Backup Configuration and save the exported file. A factory reset or hardware replacement restores your settings from backup in under a minute.
2. Shorten the DHCP lease time. Under Advanced > DHCP Server > Lease Time, set leases to 1–4 hours. All clients then receive any future DNS changes quickly rather than waiting up to 24 hours.
3. Check DNS after every firmware upgrade. Open Advanced > DHCP Server immediately after any firmware update and verify the Primary and Secondary DNS values are still set to your chosen resolver.
4. Block outbound port 53 to unauthorized resolvers (optional, advanced). IoT devices such as smart TVs and cameras often hardcode a specific public DNS IP, bypassing your DHCP settings entirely. A firewall rule blocking outbound UDP and TCP port 53 to all destinations except your chosen server forces every device through your configured resolver. Consumer Huawei routers do not support per-destination outbound firewall rules natively; this requires a separate firewall appliance or an upstream OpenWrt device.