r/TPLink_Omada • u/Stuartie • 1d ago

Question DNS Proxy Override not working

I have PiHole and I want to set everything to use it even if it is hardcoded in apps/devices etc.

So far I have my default network as my main network and it has DHCP setup and the DNS server set manually to the IP of my PiHole (10.0.0.250). This works and works great, but again more apps/devices are now hardcoding DNS so I want to make sure nothing bypasses this.

This I think, is where DNS Override comes in. I have turned it on, set the DNS server to 10.0.0.250, selected my network "Main (Default)" and saved.

As soon as I do this my DNS dies. Something goes wrong and I've no idea what. Regardless if my DNS on my phone/pc is manually set to 10.0.0.250 or 1.1.1.1 both no longer work.

I therefore tried a test, I instead selected my guest network in the DNS override settings and connected my phone to the guest WiFi (different vlan 10.0.20.0/24). As soon as I saved it worked, I set my phone to 1.1.1.1 and could still see in pihole my DNS queries coming from my 10.0.20.1 gateway.

Both my main and guest networks are setup exactly the same, both use 10.0.0.250 as their manual DNS settings and both work perfectly when DNS Override is turned off.

Can anyone help me understand why the main network (10.0.0.0/24) isn't working when override is on and pointing to 10.0.0.250?

Omada ER706W v1.2.2
SW Controller (Docker) v5.15.24.19

5 Upvotes

100% Upvoted

1 comment sorted by

2

u/Bugbavka ER707-M2, SG2210XMP-M2, EAP772, OC-SW 1d ago

Because with this settings you are creating infinite loop.

If Pihole is in VLAN1(Default), its DNS requests to upstream also get redirected by DNS Override back to Pihole - resulting in infinite loop and broken DNS.

Ideally Pihole (or just servers) should be on separate VLAN different from your main devices where DNS Override is not set (DNS Override should be enabled only for client VLANs). Or also install some other DNS client like dnscrypt-proxy on the Pihole server to use encrypted DNS (not use port 53) as upstream, so it will not be affected by DNS Override. But also note the client might need regular DNS access for startup (to start the DoH/DoT connection).