

Set up three WireGuard network interfaces on a VPS then accept traffic from your end devices to route through the three double hop VPN tunnels to a country with better privacy laws. Install an ad and tracking blocking DNS server to block all nefarious hostnames as well as more granular blockers for your browsers.
Honestly I just run Alpine Linux on a mini PC (router) or Raspberry Pi (NAS). I don’t like to screw around with outdated, bloated Debian-based distros.