Expected Behaviour:
I expect Pi-hole to block ads and tracking domains for all clients on my network, including my iPhone connected via Tailscale (subnet routing).
DNS queries from the iPhone should be resolved through Pi-hole and filtered according to the configured blocklists, both on the home Wi-Fi and over mobile data via Tailscale.
System details:
- Operating System: Debian 12 (Bookworm), running in an LXC container on Proxmox VE 9.2.3
- Hardware: Intel NUC i7-8559U (Proxmox host)
- Docker compose file / install method: Not using Docker — native Pi-hole install via the official install script inside an unprivileged LXC container
- Pi-hole version: (6.0iPhone: iOS 27 (public beta)
- Network setup: Pi-hole LXC on 192.168.178.18; Tailscale subnet router (separate LXC) advertising 192.168.178.0/24; iPhone connects via Tailscale app, DNS override enabled in the admin console pointing to 192.168.178.18
Actual Behaviour:
All other clients on the network (laptops, other phones on the same Wi-Fi) are correctly filtered by Pi-hole — ads and trackers are blocked as expected.
However, the iPhone shows no blocking at all: ads load normally on both known ad-heavy sites and in apps, whether connected via home Wi-Fi or via Tailscale over mobile data.
The Pi-hole query log shows no incoming requests from the iPhone's Tailscale IP at all, suggesting the device isn't actually sending DNS queries to Pi-hole despite the DNS settings appearing correct in the Tailscale admin panel.
Note: the iPhone is currently on the iOS 27 public beta, so I can't rule out a beta-related DNS/networking quirk, but wanted to check here first in case others have seen something similar.