When I try to connect a client to my guest network it stays at "Optaining IP address..." indefinitely. First I thought my DHCP server was not running but it works just fine on my other interfaces. Then I remembered changing some rules in my firewall to support network wide ad blocking via a forced DNS server but I only have rudimentary knowledge about this so I think I am missing something.
Note: "alfred" is my IOT network
/etc/config/dhcpcd
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
option localservice '1'
option domain 'olymp'
option local '/olymp/'
option confdir '/tmp/dnsmasq.d'
option noresolv '1'
option port '53'
list server '127.0.0.1#1053'
list server '::1#1053'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
option ra_management '1'
list dns 'fd20:cf90:8d13::1'
list domain 'olymp'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config dhcp 'guest'
option start '100'
option limit '150'
option interface 'guest'
option force '1'
option leasetime '30m'
config dhcp 'alfred'
option start '100'
option leasetime '12h'
option limit '150'
option interface 'alfred'
/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix '…'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '10.100.0.1'
config device 'lan_eth0_1_dev'
option name 'eth0.1'
option macaddr '…'
config interface 'wan'
option ifname 'eth0.2'
option proto 'dhcp'
config device 'wan_eth0_2_dev'
option name 'eth0.2'
option macaddr '…'
config interface 'wan6'
option ifname 'eth0.2'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
option ar8xxx_mib_type '0'
option ar8xxx_mib_poll_interval '500'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 2 3 4 0t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '5 0t'
config interface 'alfred'
option proto 'static'
option netmask '255.255.255.0'
option ipaddr '10.200.0.1'
config interface 'vpn'
option proto 'wireguard'
option private_key '…'
option listen_port '80'
list addresses '1234:5678::1/64'
config wireguard_vpn
option route_allowed_ips '1'
option public_key '…'
option description '…'
list allowed_ips '1234:5678::3/128'
config wireguard_vpn
option route_allowed_ips '1'
option public_key '…'
option description '…'
list allowed_ips '1234:5678::2/64'
config interface 'guest'
option proto 'static'
option ipaddr '192.168.0.1'
option netmask '255.255.255.0'
/etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone 'lan'
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'vpn'
config zone 'wan'
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
option enabled '0'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
option enabled '0'
config include
option path '/etc/firewall.user'
config zone 'guestzone'
option forward 'REJECT'
option name 'guestzone'
option output 'ACCEPT'
list network 'guest'
option input 'REJECT'
config zone 'alfredzone'
option input 'ACCEPT'
option forward 'REJECT'
option name 'alfredzone'
option output 'ACCEPT'
list network 'alfred'
config forwarding
option dest 'alfredzone'
option src 'lan'
config forwarding
option dest 'wan'
option src 'guestzone'
config rule
option src 'guestzone'
option name 'Guest DHCP'
option target 'ACCEPT'
list proto 'tcp'
list proto 'udp'
option dest_port '67 68'
config rule
option src 'guestzone'
option name 'Guest DNS'
option proto 'tcp udp'
option target 'ACCEPT'
option dest_port '53 853 5353'
config redirect 'adblock_dns_53'
option name 'Adblock DNS, port 53'
option src 'lan'
option proto 'tcp udp'
option src_dport '53'
option dest_port '53'
option target 'DNAT'
config redirect 'adblock_dns_853'
option name 'Adblock DNS, port 853'
option src 'lan'
option proto 'tcp udp'
option src_dport '853'
option dest_port '853'
option target 'DNAT'
config redirect 'adblock_dns_5353'
option name 'Adblock DNS, port 5353'
option src 'lan'
option proto 'tcp udp'
option src_dport '5353'
option dest_port '5353'
option target 'DNAT'
config rule
option dest 'wan'
option proto 'tcp udp'
option dest_port '53 853 5353'
option target 'REJECT'
option src '*'
option name 'Block public DNS'
config rule 'wg'
option name 'Allow WireGuard'
option src 'wan'
option dest_port '80'
option target 'ACCEPT'
list proto 'udp'
config zone 'lonely'
option name 'zerotier'
option input 'ACCEPT'
option forward 'REJECT'
option output 'ACCEPT'
option device 'zt+'
option masq '1'
option mtu_fix '1'
config forwording
option dest 'zerotier'
option src 'lan'
config forwarding
option dest 'lan'
option src 'zerotier'