@Pashovski
You will need to create firewall rules in your router to allow the devices on the IoT VLAN to be able to send DNS requests (& receive replies) to/from the MAIN LAN's Pi-hole.
Thanks for the reply. I'll add my rules here. I've tried reading through every one of the dozens of USG + Pihole threads. I am not sure at this point if it is my rules or something in the Pi-Hole setup that is wrong. Along with not being able to log into Pi-hole when connected to my IoT network, I am not able to log into my Unifi Controller. My Current setup is USG > 8-switch-60w > Pi-hole.
@Pashovski
FWIW. I have a Ubiquiti UniFi network. I have a pair of Pi-holes running on my native LAN and employ a number of VLANs, including one for IoT devices. My first FW rule is a LAN IN rule that is similar to your rule 2000. This allows all established/related traffic between all VLANs.
Specifically for the Pi-hole, I have a LAN IN rule for each VLAN that I want to have access to the Pi-holes. This rule accepts new, established, & related TCP and UDP traffic on ports 53 & 5335 from the VLAN to the LAN.
And in my case, I use a third rule which blocks everything else from the VLAN to the LAN.
With these three rules, I do not have any issues using my Pi-holes for DNS requests. All of my IoT devices (like my Davis Advantage Pro & NetAtmo weather stations) can easily send their respective data over the Internet.
2 piholes! that is cool. Maybe i should look into that, although I should probably keep it simple and figure this out first
Would you mind telling me, what do you have listed for domain in IoT vlan domain field? I just realized mine (IoT) is blank; i have localdomain for my MAIN VLAN. Wondering if that might be a problem
I have a LAN IN rule for each VLAN that I want to have access to the Pi-holes. This rule accepts new, established, & related TCP and UDP traffic on ports 53 & 5335 from the VLAN to the LAN. Blockquote
Am I right that "from" the VLAN = (Destination) "to" the LAN = (Source) ?
Also the source is Address/Port Group ANY/ANY, and the destination is Address/Port Group 192.168.1.5/Port 53 & 5335? (That's my pi-hole IP)
DESTINATION Destination Type: Address/Port Group IPv4 Address Group: Pi-hole Address Group << I created a FW group of type "IPv4 Address/subnet" that includes the IPv4 addresses of my two Pi-holes Port Group: DNS Port Group << I created a FW group of type "Port Group" that includes ports 53 & 5335. The latter port is only required if you opt to run unbound on your Pi.
ADVANCED
Match State New - enabled
Match State Established - enabled
Match State Related - enabled
