Pihole plus Guest Wifi on different IP range

Sorry for a bit of an absence, but there were other weekend activities keeping me relaxed :wink:

I've tried to emulate parts of your scenario in my network and succeded with minor adjustments.

Note

Of course, I use different IP address ranges, but have tried to remember altering them to match your scenario when quoting them here. Still, better double check IP addresses when copying :wink:


First, I switched configuring the Pi's (your SunnySide's) static IP addresses via dhcpcd.conf just like you, instead of denying the interfaces there and using /etc/network/interfaces for configuration.
The difference is in how I configure wlan0 in
/etc/dhcpcd.conf

interface wlan0
     static ip_address=10.0.0.1/24
     static routers=192.168.1.1
     static domain_name_servers=127.0.0.1
     nohook wpa_supplicant

As you can see, I keep localhost (SunnySide) as DNS server and try to prevent wlan0 from being configured as a potential client by wpa_supplicant.

Then I tried binding the DHCP configuration options specific for your guest wlan to wlan0 explicitly in
/etc/dnsmasq.d/09-guestnet.conf:

interface=wlan0
dhcp-range=wlan0,10.0.0.100,10.0.0.200,4h
dhcp-option=wlan0,option:router,10.0.0.1
dhcp-option=wlan0,option:dns-server,10.0.0.1

So SunnySide will propagate itself as router/gateway as well as DNS server to its clients in the 10.x.x.x sub-network bound to wlan0. I didn't touch any of the Pi-hole's own dnsmasq.d/ configuration files.
I have, however, setup some static leases, which resulted in Pi-hole's web admin panel complaining about missing files at first as well as in creation of a few extra config files - they are explained in What files does Pi-hole use?, with the exception of the file for static leases themselves, 04-pihole-static-dhcp.conf.
[EDIT]
It probably would have been nice to assign an alternate domain name for the 10.x.x.x clients, but I have failed to do so. Attaching an interface to the domain directive (e.g.domain=wlan0,guest-wlan) results in FTL faliure to start, whereas just stating another domain is ignored.
[/EDIT]

The last difference remains with my iptables configuration:

I doubt that your additional lines have any influence on the problem, but thought I mention it nonetheless.

Sidenote: How I store rules for iptables

This certainly has no effect on the solution - it's just another way to store iptables rules. I use iptables-persistent for this:
sudo apt-get install iptables-persistent
to install and initial save of ip(6)tables configurations. Configuration files will be stored under /etc/iptables/ and will be automatically read at boot time.
sudo dpkg-reconfigure iptables-persistent
to save later modifications.


With these configurations, I was able to connect my Laptop to my 192.x.x.x (standard gateway 192.x.x.1 as reported by Windows) as well as to my 10.x.x.x network (standard gateway 10.x.x.1 as reported by Windows) with the correct gateway and traffic being filtered by Pi-hole.
(Should you need to add IPV6 support for SunnySides clients, additional configuration steps will have to be made.)

I hope it'll do the same for you.