[SOLVED] Configuring out-of-subnet DNS for guest network

First let me say that I like running things in a 'configuration as code' manner, so I opt to update config files and restart services rather than use luci or the gui.

My primary lan is configured to, and all DNS is handled by a pihole at

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr ''
        option netmask ''
        option ip6assign '60'
        option delegate '0'

I'm setting up a guest network on, and if I let it use the openwrt device (and my ISP) then everything works just fine:

config interface 'guest_br'
        option type 'bridge'
        option proto 'static'
        option ipaddr ''
        option netmask ''

config wifi-iface 'wifinet5'
        option network 'guest_br'
        option ssid 'GuestVAP'
        option encryption 'psk2'
        option device 'radio0'
        option mode 'ap'
        option key 'PASSCODE'

I want the guest network to be separated from my primary lan, and also to use the pihole for DNS, gateway for DHCP:

config zone 'guest'
        option name 'guest'
        option network 'guest_br'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding 'guest_wan'
        option src 'guest'
        option dest 'wan'

config rule 'guest_dns'
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option dest_ip ''
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'guest_dhcp'
        option name 'Allow-DHCP-Guest'
        option src 'guest'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config dhcp 'guest'
        option interface 'guest_br'
        option start '100'
        option limit '150'
        option leasetime '24h'
        list dhcp_option '6,'

Even so, when I'm on the guest network I can't seem to query the pihole for DNS.

me@laptop$ systemd-resolve --status | grep Current
      Current Scopes: none
      Current Scopes: none
      Current Scopes: DNS         
  Current DNS Server:
      Current Scopes: none
me@laptop$ nslookup debian.org
;; connection timed out; no servers could be reached

What could I be doing wrong?

You missed the destination zone (option dest 'lan'), which makes the rule part of the iptables INPUT chain, instead of the FORWARD one.


This did it, thank you!

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.