AdGuard home and VLANs

tneck · November 18, 2025, 3:55am

Hi,
I'm having trouble getting AdGuard to work on my non-main VLANs. I followed the instructions here: https://openwrt.org/docs/guide-user/services/dns/adguard-home

The only thing I changed was the first two Setup lines. Rather than getting the IP with: ip -o -4 addr list br-lan I used ip -o -4 addr list br-lan.1

AdGuard home works on my main VLAN, but the DNS isn't set for my VLANs. When I run resolvectl status on my linux box, no DNS servers are set.

Here are my dhcp, network and firewall files:

DHCP

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	list interface 'HA'
	list interface 'IoT'
	list interface 'lan'
	option port '54'
	option noresolv '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	list dhcp_option '3,192.168.0.1'
	list dhcp_option '6,192.168.0.1'
	list dhcp_option '15,lan'
	list dns 'fd7b:9a13:5372::1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
	option piofolder '/tmp/odhcpd-piofolder'

config dhcp 'HA'
	option interface 'HA'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'IoT'
	option interface 'IoT'
	option start '100'
	option limit '150'
	option leasetime '12h'

NETWORK:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd7b:9a13:5372::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '192.168.0.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'eth1'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan1:u*'
	list ports 'lan2:u*'
	list ports 'lan3:u*'
	list ports 'lan4:u*'

config interface 'HA'
	option proto 'static'
	option device 'lan5'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'

config interface 'IoT'
	option proto 'static'
	option device 'br-iot'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'

config device
	option type 'bridge'
	option name 'br-iot'
	option bridge_empty '1'

FIRWALL:

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'ha_zone'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'HA'

config zone
	option name 'iot_zone'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'IoT'

config forwarding
	option src 'iot_zone'
	option dest 'ha_zone'

config forwarding
	option src 'iot_zone'
	option dest 'wan'

config rule
	option src 'iot_zone'
	option name 'IoT_DHCP_DNS'
	option target 'ACCEPT'
	option dest_port '67 53'

config rule
	option src 'ha_zone'
	option name 'HA_DHCP_DNS'
	option target 'ACCEPT'
	option dest_port '67 53'

config rule
	option src 'lan'
	option name 'Allow_LAN-HA'
	option target 'ACCEPT'
	option dest_port '8123'
	option dest 'ha_zone'

config rule
	option src 'ha_zone'
	option name 'Allow_HA-IoT'
	option target 'ACCEPT'
	option dest 'iot_zone'
	list proto 'all'

config forwarding
	option src 'lan'
	option dest 'ha_zone'

config forwarding
	option src 'ha_zone'
	option dest 'lan'

config rule
	option src 'iot_zone'
	option dest 'ha_zone'
	option name 'mDNS_IoT-to-HA'
	option src_port '5353'
	list dest_ip '224.0.0.251'
	option dest_port '5353'
	option target 'ACCEPT'

config rule
	option src 'ha_zone'
	option dest 'iot_zone'
	option name 'mDNS_HA-to-IoT'
	option src_port '5353'
	list dest_ip '224.0.0.251'
	option dest_port '5353'
	option target 'ACCEPT'

pavelgl · November 18, 2025, 6:59am

You must set DHCP option 6 for the HA and IoT interfaces as well.

tneck · November 19, 2025, 4:51am

Thanks very much, adding option 6 for the two other vlans using the router's vlan IP worked!

system · November 29, 2025, 4:52am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.