Trouble Passing Real Client IPs from Dnsmasq to AdGuard Home → NextDNS

Routers
1

Hi everyone,
I'm running a layered DNS setup at home for better control and visibility:
Device: GL-MT6000 Flint2 - OpenWrt 21.02-SNAPSHOT
Kernel: 5.4.238

LAN client → Dnsmasq (handles DHCP & DNS) → AdGuard Home (ad-blocking) → NextDNS (DoH resolver)

Dnsmasq is handling DHCP and DNS.
AdGuard Home is running on my GL.iNet Flint 2 router.
NextDNS is configured in AdGuard Home as the upstream resolver via DoH.
On NextDNS, I do see the real client IPs (great!).
But in AdGuard Home, all clients appear as 127.0.0.1 or the router IP, not the actual LAN device IPs.

image
image1176×433 41.5 KB

I already tried:

Setting add-mac, add-subnet=32,128 in dnsmasq.
Enabling EDNS Client Subnet (ECS) support in AdGuard Home.
Testing with and without strict-order , bogus-priv, no-resolv options.
Verified DHCP leases are assigning correctly and contain MAC info.

Still, AdGuard Home doesn’t log the real LAN client IPs, which makes per-device filtering and stats useless.

What I want:
See real LAN client IPs inside AdGuard Home, not just on NextDNS.

My Questions:

  1. Is there a known method or config combination that allows dnsmasq to pass real client IPs to AdGuard Home running on the router?
  2. Does AdGuard Home need to run on a separate device to capture LAN IPs properly?
  3. Would changing the chain (e.g, clients → AdGuard → dnsmasq → NextDNS) help resolve the IP logging issue?
    Any advice or insight would be appreciated. Happy to share more config details if helpful.

Thanks in advance!
Arnold

2

Hi everyone!!
Anyone who has the same setup or technical expertise to provide a guidance?

Appreciate.

3

Hello,

  1. Is the MT6000 installed firmware version v4.7.7?

  2. Is VPN client disabled?

  3. Is the "AdGuard Home Handle Client Requests" enabled?

4

Hey Bruce, tks for your time.

Version ok V7
No VPN, I'm using Tailscale instead.
Clinet Request. I don't know what is this option. However, only to make it clear, this is my setup: clients → AdGuard → dnsmasq → NextDNS Therefore, dnsmasq is handle clients and Adguard is the ad blocker.

I fill like I'm missing something.
File etc/dnsmasq I've included:
no-resolv
bogus-priv
strict-order
server=127.0.0.1#3053

And have tried many diffent way testin flaging and unflagging AdGuard options. Nothing make it works.

Maybe my setup is not appropriate one.

Tks again.

5

Hello,

May I know if this option is enabled?

Bruce_2025-06-20_14-46-11
Bruce_2025-06-20_14-46-111291×687 47.5 KB

6

Hey, tks for you question. Nope... I didn't enable because I'm using dnsmasq as my DNS. The Idea is to use Aduard only as ad blocker.

Cheers.

7

And the only reason that I'm using AdGuard is because Flint 2 has it already integrated. Otherwise, I would prefer Pi-Hole. But, for it will be required an extra container or vm, and I don't wanna at least for now extra stuff to manager.
cheers

8

The reason is the dnsmasq already handle all DNS requests, ADG can only display localhost. I think this is not an issue in router firmware.

If you require the ADG statistics list to display client IP, may enable the "AdGuard Home Handle Client Requests".

9

I had the same problem with my pihole.

Was seeing all forwarded DNS lookups as coming from the LAN IP of the router. I just enabled EDNS on dnsmasq.
SSH into the router, go to /etc/dnsmasq.conf added 2 lines
add-mac
add-subnet=32

Original client IP comes through to Pihole now.

10

Hi, does the pihole ADG work fine now?