Using Pihole DNS for Guest/IoT networks?

[DanTup]

I’ve just ordered a Flint 3E router and hope to set Pihole back up (my current ISP router doesn’t allow me to modify DHCP or DNS settings!).

I’d like to move my IoT devices to the IoT network, but I would also prefer them to go through Pihole. I’d like to keep isolation enabled so the IoT devices cannot connect to anythign on the main network - except for Pihole.

What’s the best way to have the IoT network use Pihole for DNS (and ensure their real IP addresses show up, not the gateways IP address)?

[charles2]

Hi,

Thanks for the details. This can be configured while keeping the IoT network isolated from the main LAN.

For example, assuming your Pi-hole is 192.168.8.2 on the main LAN, you can configure it as follows:

1. Assign Pi-hole as the DNS server for the IoT network
   Go to NETWORK → IoT Network → DHCP Server → Advanced, and set:

DNS Server 1: 192.168.8.2
DNS Server 2: Leave blank

This makes the IoT clients query Pi-hole directly.
2. Allow only DNS traffic from IoT to Pi-hole
Go to LuCI → Network → Firewall → Traffic Rules and add a rule similar to the following:

Name: Allow-IoT-PiHole-DNS
Protocol: TCP + UDP
Source zone: iot
Destination zone: lan
Destination address: 192.168.8.2
Destination port: 53
Action: Accept

With this rule, IoT devices can only access the Pi-hole DNS service on the main LAN.

3. Pi-hole setting
   Because the IoT network is a different subnet, Pi-hole may reject these requests when Allow only local requests is selected.
   In Pi-hole, please go to the DNS interface/listening settings and select Permit all origins.

[DanTup]

@charles2 thank you! It was simpler than I expected, I should’ve clicked through LuCI first

I appreciate the quick and detailed response - I was already very happy with this router (my ISP router is baaaaad), but having responsive staff in the forums makes me even happier with this choice. Thanks!

[knee_mountain523]

Following this!