Isolate network with DNS but without NAT

We have the following situation:

Screenshot from 2023-07-19 20-21-45

Our landlord provides a network to us and the neighbors. Because we are all in the same network, we would like to isolate our devices so they cannot be seen or accessed from other tenants. Furthermore we would like to use our own DNS (pi-hole). Using NAT is not an option as it slows down the internet speed significantly (~200Mbit to ~20Mbit).

DHCP and DNS are provided by the landlords devices and we cannot access them or ask him to change anything (already tried).

Our Idea is to use firewall rules to protect our network and to block the landlords DHCP. Then we can use our own DHCP and therefore our DNS. The problem is that in this case our DHCP gives out IP addresses without knowledge of the landlords DHCP, but in the same network.

Is there an option to configure a DHCP to get the IPs from another (landlord)DHCP but announces our DNS? Or if there is a completely different solution (not NAT) I would be happy to hear it :slight_smile:

DNS doesn't isolate networks. It is purely a method of converting a domain name ( into an IP address ( That's all it does -- it is "Domain Name System"

To isolate your network, you need to use routing.. typically NAT + firewall is used, but if you have control over the upstream rotuer, you can setup a non-NAT routed configuration and setup the firewall to prevent your neighbors from accessing your devices.

That is rather hard to believe unless you're using a really old or low end device. What are you using? Are you using OpenWrt? Let's see the output of this:

ubus call system board


without over complicated L2 filtering ...
your only choice is to ask your landlord to enter static route in his device and give you static LAN address
existing network
your OWRT wan
your OWRT lan
static route on primary router: via

I mentioned that, too, but the OP had mentioned that they cannot get the landlord to make any changes to the network for them.

This means that NAT Masquerading is the only option.

1 Like


looks like i skipped this part of your reply :frowning: