# VLANs with DHCP + DNS...almost

**URL:** <https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862>\
**Category:** Customizing Pi-hole\
**Tags:** dhcp\
**Created:** [September 1, 2020, 2:22am UTC](https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862 "2020-09-01T02:22:28Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gandalf](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/59ef9b/32.png) [@Gandalf](https://discourse.pi-hole.net/u/Gandalf)\
**Post date:** [September 1, 2020, 2:22am UTC](https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862/1 "2020-09-01T02:22:28Z")

</div>

I recently found [this comment by @slowlearner](https://discourse.pi-hole.net/t/extra-dhcp-server-options/6416/5) showing how to add VLANs.

I followed it to the letter. I didn't change any existing .conf files and I only created one: `10-vlans.conf`. It looks like this:

```plaintext
#2020-08-29 2:01 PM
#Adding VLANs for Pi-Hole to run DHCP + DNS
# 96, 98, 99, 104, 151

#Source @slowlearner on discourse.pi-hole.net/t/extra-dhcp-server-options/6416/5

#Step 4
log-dhcp

#Step 5 - Configure VLANS
# Start IP Range at .3 to avoid Gateway on .2
# Stop IP Range at .250 because I like round numbers

#Example Line 1: dhcp hyphen range equals set colon VLANID comma IPRangeStart comma IPRangeEnd comma SubnetMask comma LeaseDuration
#Example Line 2: dhcp hyphen option equals tag colon VLANID comma option colon router comma GatewayIP

dhcp-range=set:151,192.168.151.3,192.168.151.250,255.255.255.0,24h
dhcp-option=tag:151,option:router,192.168.151.2

dhcp-range=set:96,192.168.96.3,192.168.96.250,255.255.255.0,24h
dhcp-option=tag:96,option:router,192.168.96.2

dhcp-range=set:97,192.168.97.3,192.168.97.250,255.255.255.0,24h
dhcp-option=tag:97,option:router,192.168.97.2

dhcp-range=set:98,192.168.98.3,192.168.98.250,255.255.255.0,24h
dhcp-option=tag:98,option:router,192.168.98.2

dhcp-range=set:99,192.168.99.3,192.168.99.250,255.255.255.0,24h
dhcp-option=tag:99,option:router,192.168.99.2

dhcp-range=set:104,192.168.104.3,192.168.104.250,255.255.255.0,24h
dhcp-option=tag:104,option:router,192.168.104.2

```

When I ran `dnsmasq --test`, it returned `syntax check OK`.

The trouble that I run into is that some machines on some VLANs are not working. Some show up in the DHCP leases but cannot be reached. Some don't show up anywhere.

Can you confirm that this .conf matches my objective? Any idea what is wrong?

NB: This was a VLAN setup on a Meraki MX84 that was migrated to Pi-Hole when I found out (the hard way) that the Meraki will not handle internal DNS, so I had a severe deficiency in the area of internal hostname resolution. **None of the wiring has changed.** Patch panels and managed switches are the same as they were before. Any input is appreciated.

---

<div class="post-metadata">

**Author:** ![Coro](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/coro/32/15424_2.png) [@Coro](https://discourse.pi-hole.net/u/Coro)\
**Post date:** [September 1, 2020, 12:43pm UTC](https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862/2 "2020-09-01T12:43:08Z")

</div>

> [@Gandalf](#):
>
> but cannot be reached

Cannot be reached from the devices in their own VLAN, from devices in the other VLANs or not at all? Do these devices have Internet access or can they reach the Pi-hole?

---

<div class="post-metadata">

**Author:** ![Gandalf](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/59ef9b/32.png) [@Gandalf](https://discourse.pi-hole.net/u/Gandalf)\
**Post date:** [September 1, 2020, 3:45pm UTC](https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862/3 "2020-09-01T15:45:57Z")

</div>

Hi @Coro, Cannot be reached means no contact from any direction. No ping from the same VLAN or by ping from the Pi-Hole server or with our remote access program ([Veyon](http://veyon.io)).

These machines cannot connect out to the internet.

---

<div class="post-metadata">

**Author:** ![Coro](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/coro/32/15424_2.png) [@Coro](https://discourse.pi-hole.net/u/Coro)\
**Post date:** [September 2, 2020, 8:56am UTC](https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862/4 "2020-09-02T08:56:17Z")

</div>

Are you sure the respective gateways (like `192.168.99.2`, `192.168.98.2`, etc.) do all exist and know the routes from everywhere to everywhere else? And why are they at `.2` ? This is unusual at least.

---

<div class="post-metadata">

**Author:** ![Gandalf](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/59ef9b/32.png) [@Gandalf](https://discourse.pi-hole.net/u/Gandalf)\
**Post date:** [September 2, 2020, 3:16pm UTC](https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862/5 "2020-09-02T15:16:08Z")

</div>

Yes, the gateways are all set up. They were working fine when DHCP was on another server.

I didn't set up the Router, so I don't know why they are on `.2` but I don't want to change too many things at once, so I left them that way until I got the DHCP working properly.

The weird part is that some of the workstations are fine, but some of them don't work at all. Does that mean that the issue is somewhere else? (I wonder if the managed switch is the problem.)

---

<div class="post-metadata">

**Author:** ![Coro](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/coro/32/15424_2.png) [@Coro](https://discourse.pi-hole.net/u/Coro)\
**Post date:** [September 3, 2020, 1:58pm UTC](https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862/7 "2020-09-03T13:58:17Z")

</div>

Maybe, do you have some Linux machines seeing the issue? If so, use the other DHCP server and run

```auto
sudo nmap -e eth0 --script broadcast-dhcp-discover

```

then run the same with the Pi-hole DHCP server and watch out for any differences. (I borrowed the command from @deHakkelaar)

---

<div class="post-metadata">

**Author:** ![Gandalf](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/59ef9b/32.png) [@Gandalf](https://discourse.pi-hole.net/u/Gandalf)\
**Post date:** [October 19, 2020, 5:24pm UTC](https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862/8 "2020-10-19T17:24:08Z")

</div>

Thank you for your input. I got some help from a friend who knows DNSmasq. He created a `dnsmasq.conf` file for me and I was able to use it with Pi-Hole. I renamed it `03-custom.conf` and it worked like a charm.

For anyone joining this topic later, yes, you can run DHCP on multiple VLANs with Pi-Hole.  
(As a token of my appreciation, I have added my monthly support on Patreon.) This will save us a LOT of time, money, and hardware in the long run. Feel free to message me with any specific questions. I took notes on my experience.

Here's a copy of our `DNSmasq.conf` file:

> # Never forward plain names (without a dot or domain part)  
> domain-needed  
> # If you don't want dnsmasq to read /etc/resolv.conf or any other  
> # file, getting its servers from this file instead (see below), then uncomment this.  
> no-resolv  
> # Put DNS server IP addresses in here  
> server=1.1.1.1  
> server=1.0.0.1  
> # Put IP address of DHCP server here  
> listen-address=192.168.211.187  
> # Make sure this is the domain name you want the clients to have  
> domain=example.com  
> # This is an example of a DHCP range where the netmask is given. This is needed for networks we  
> reach the dnsmasq DHCP server via a relay agent. If you don't know what a DHCP relay agent is,  
> you probably don't need to worry about this.  
> dhcp-range=set:subnet96,192.168.96.10,192.168.96.250,255.255.255.0,12h  
> dhcp-range=set:subnet97,192.168.97.10,192.168.97.250,255.255.255.0,12h  
> dhcp-range=set:subnet98,192.168.98.10,192.168.98.250,255.255.255.0,12h  
> dhcp-range=set:subnet99,192.168.99.10,192.168.99.250,255.255.255.0,12h
> 
> # Do the same thing, but using the option name  
> dhcp-option=tag:subnet96,option:router,192.168.96.1  
> dhcp-option=tag:subnet97,option:router,192.168.97.1  
> dhcp-option=tag:subnet98,option:router,192.168.98.1  
> dhcp-option=tag:subnet99,option:router,192.168.99.1

---

<div class="post-metadata">

**Author:** ![Coro](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/coro/32/15424_2.png) [@Coro](https://discourse.pi-hole.net/u/Coro)\
**Post date:** [October 21, 2020, 9:58am UTC](https://discourse.pi-hole.net/t/vlans-with-dhcp-dns-almost/37862/9 "2020-10-21T09:58:16Z")

</div>

> [@Gandalf](#):
>
> This will save us a LOT of time, money, and hardware in the long run.

Plus you learned something and shared your insight. Thank you.

For those joining in later, only the following lines are relevant:

> [@Gandalf](#):
>
> ```auto
> # Put IP address of DHCP server here
> listen-address=192.168.211.187
> 
> # This is an example of a DHCP range where the netmask is given. This is needed for networks we
> reach the dnsmasq DHCP server via a relay agent. If you don't know what a DHCP relay agent is,
> you probably don't need to worry about this.
> dhcp-range=set:subnet96,192.168.96.10,192.168.96.250,255.255.255.0,12h
> dhcp-range=set:subnet97,192.168.97.10,192.168.97.250,255.255.255.0,12h
> dhcp-range=set:subnet98,192.168.98.10,192.168.98.250,255.255.255.0,12h
> dhcp-range=set:subnet99,192.168.99.10,192.168.99.250,255.255.255.0,12h
> 
> # Do the same thing, but using the option name
> dhcp-option=tag:subnet96,option:router,192.168.96.1
> dhcp-option=tag:subnet97,option:router,192.168.97.1
> dhcp-option=tag:subnet98,option:router,192.168.98.1
> dhcp-option=tag:subnet99,option:router,192.168.99.1
> 
> ```

the others are already contained in other files of Pi-hole, duplicating them may result in errors