diff -urN freebsd8.orig/webgui/system_advanced.php freebsd8/webgui/system_advanced.php
--- freebsd8.orig/webgui/system_advanced.php	2014-02-06 22:57:36.632848096 +0100
+++ freebsd8/webgui/system_advanced.php	2014-02-14 14:51:05.178594576 +0100
@@ -32,6 +32,9 @@
 $pgtitle = array("System", "Advanced setup");
 require("guiconfig.inc");
 $pconfig['nospoofcheck'] = isset($config['bridge']['nospoofcheck']);
+$pconfig['dnscrypt'] = isset($config['system']['dnscrypt']['enable']);
+$pconfig['dnscryptdns'] = $config['system']['dnscrypt']['dnscryptdns'];
+$pconfig['dnscryptport'] = $config['system']['dnscrypt']['dnscryptport'];
 $pconfig['mbmon'] = isset($config['system']['webgui']['mbmon']['enable']);
 $pconfig['cert'] = base64_decode($config['system']['webgui']['certificate']);
 $pconfig['key'] = base64_decode($config['system']['webgui']['private-key']);
@@ -73,6 +76,12 @@
 	$pconfig = $_POST;
 
 	/* input validation */
+	if (($_POST['dnscryptdns'] && !is_ipaddr4or6($_POST['dnscryptdns']))) {
+		$input_errors[] = "A valid IP address must be specified for the DNS server.";
+	}
+	if (($_POST['dnscryptport'] && !is_port($_POST['dnscryptport']))) {
+		$input_errors[] = "The server port must be an integer between 1 and 65535.";
+	}
 	if ($_POST['ipsecdnsinterval'] && !is_numericint($_POST['ipsecdnsinterval'])) {
 		$input_errors[] = "The IPsec DNS check interval must be an integer.";
 	}
@@ -96,6 +105,12 @@
 
 	if (!$input_errors) {
 		$config['bridge']['nospoofcheck'] = $_POST['nospoofcheck'] ? true : false;
+		$olddnscrypt = isset($config['system']['dnscrypt']['enable']);
+		$config['system']['dnscrypt']['enable'] = $_POST['dnscrypt'] ? true : false;
+		$olddcdns = $config['system']['dnscrypt']['dnscryptdns'];
+		$config['system']['dnscrypt']['dnscryptdns'] = $_POST['dnscryptdns'];
+		$olddcport = $config['system']['dnscrypt']['dnscryptport'];
+		$config['system']['dnscrypt']['dnscryptport'] = $_POST['dnscryptport'];
 		$config['system']['webgui']['mbmon']['enable'] = $_POST['mbmon'] ? true : false;
 		$config['system']['webgui']['mbmon']['type'] = $_POST['mbmontype'];
 		$oldcert = $config['system']['webgui']['certificate'];
@@ -157,6 +172,10 @@
 			if (isset($config['ipsec']['preferoldsa']) != $oldpreferoldsa || $config['ipsec']['dns-interval'] != $oldipsecdnsinterval) {
 				$retval |= vpn_ipsec_configure();
 			}
+			if ((isset($config['system']['dnscrypt']['enable']) != $olddnscrypt) || ($config['system']['dnscrypt']['dnscryptdns'] != $olddcdns) || ($config['system']['dnscrypt']['dnscryptport'] != $olddcport)) {
+				$retval |= system_dnscrypt_configure();
+				$retval |= services_dnsmasq_configure();
+			}
 			$retval |= system_set_termcap();
 			config_unlock();
 		}
@@ -191,6 +210,41 @@
                 </tr>
                 <tr> 
                   <td width="22%" valign="top">&nbsp;</td>
+                  <td width="78%"> 
+                    <input name="Submit" type="submit" class="formbtn" value="Save"> 
+                  </td>
+                </tr>
+                <tr> 
+                  <td colspan="2" class="list" height="12"></td>
+                </tr>
+		<tr> 
+                  <td colspan="2" valign="top" class="listtopic">DNSCrypt</td>
+                </tr>
+                <tr> 
+                  <td width="22%" valign="top" class="vncell">DNSCrypt</td>
+                  <td width="78%" class="vtable"> 
+			<input name="dnscrypt" type="checkbox" id="dnscrypt" value="yes" <?php if ($pconfig['dnscrypt']) echo "checked"; ?>>
+			<strong>Enable DNSCrypt</strong>
+			<span class="vexpl">
+				<br>This enables DNSCrypt for requests to the local DNS forwarder.
+				<br>All requests from the DNS forwarder are sent encrypted to the DNS server.
+			</span>
+		  </td>
+		</tr>
+		<tr>
+                  <td width="22%" valign="top" class="vncell">DNSCrypt server ip/port</td>
+                  <td width="78%" class="vtable"> 
+			<input name="dnscryptdns" type="text" class="formfld" id="dnscryptdns" size="20" value="<?=htmlspecialchars($pconfig['dnscryptdns']);?>"> : 
+			<input name="dnscryptport" type="text" class="formfld" id="dnscryptport" size="5" value="<?=htmlspecialchars($pconfig['dnscryptport']);?>">
+			<span class="vexpl">
+				<br>IP address and port of the DNSCrypt enabled DNS server.
+				<br>The DNS servers under General setup are ignored when DNSCrypt is enabled.
+				<br>If these fields are empty, OpenDNS is used.
+			</span>
+		  </td>
+                </tr>
+                <tr> 
+                  <td width="22%" valign="top">&nbsp;</td>
                   <td width="78%"> 
                     <input name="Submit" type="submit" class="formbtn" value="Save"> 
                   </td>
