I am trying to rollout a Pihole server to a three subnet network (192.168.70.0/24, 192.168.80.0/24, 192.168.90.0/24).
The evaluation process is to insert the pihole (192.168.80.20) in one subnet (192.168.80.0/24) for initial testing. Then expand the introduction to have a second subnet (192.168.70.0/24) & third subnet (192.168.90.0/24) use the same Pihole server.
For the testing specific hosts in each subnet are configured to use the Pihole. After successful testing DHCP would be configured to direct the subnet hosts to the Pihole server.
For initial testing hosts in the .80 & .70 use the linux dig command to make DNS requests to the Pihole server. Tcpdump is used on the Pihole to monitor the connection.
Dig requests from the .80 subnet host work. Dig requests from the .70 do not work.
The Pihole receives a request and responds to a dig command from the .80 subnet.
WORKING 192.168.80.0/24
dig @192.168.80.20 microsoft.com
; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> @192.168.80.20 microsoft.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64179
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;microsoft.com. IN A
;; ANSWER SECTION:
microsoft.com. 2058 IN A 13.107.253.70
microsoft.com. 2058 IN A 13.107.226.70
;; Query time: 27 msec
;; SERVER: 192.168.80.20#53(192.168.80.20) (UDP)
;; WHEN: Thu Oct 02 07:50:45 CDT 2025
;; MSG SIZE rcvd: 74
sudo tcpdump -i eth0 port 53 and host 192.168.80.2
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
07:50:45.503728 IP 192.168.80.2.55057 > 192.168.80.20.domain: 64179+ [1au] A? microsoft.com. (54)
07:50:45.532318 IP 192.168.80.20.domain > 192.168.80.2.55057: 64179 2/0/1 A 13.107.253.70, A 13.107.226.70 (74)
The Pihole receives a dig request from the .70 subnet but does not respond.
FAILED 192.168.70.0/24
dig @192.168.80.20 microsoft.com
;; communications error to 192.168.80.20#53: timed out
;; communications error to 192.168.80.20#53: timed out
;; communications error to 192.168.80.20#53: timed out
; <<>> DiG 9.18.39-0ubuntu0.22.04.1-Ubuntu <<>> @192.168.80.20 microsoft.com
; (1 server found)
;; global options: +cmd
;; no servers could be reached
sudo tcpdump -i eth0 port 53 and host 192.168.70.246
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
07:53:55.373157 IP 192.168.70.246.39610 > 192.168.80.20.domain: 10220+ [1au] A? microsoft.com. (54)
07:54:00.378810 IP 192.168.70.246.49652 > 192.168.80.20.domain: 10220+ [1au] A? microsoft.com. (54)
07:54:05.384826 IP 192.168.70.246.57006 > 192.168.80.20.domain: 10220+ [1au] A? microsoft.com. (54)
What configuration am I missing to support the Pihole server from other subnets.
export
# 2025-10-02 07:59:42 by RouterOS 7.19.2
# software id = #
# model = RB4011iGS+5HacQ2HnD
# serial number =
/interface bridge
add admin-mac=auto-mac=no comment=defconf name=bridge
add comment="subnet build" name="bridge 70"
add comment="subnet build" name="bridge 80"
add comment="subnet build" name="bridge 90"
add comment="guest wifi build" name=guest-bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX comment="guest wifi build" country=canada default-forwarding=no disabled=no distance=indoors frequency=\
auto mode=ap-bridge ssid=RRS_Guest_2G wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX comment="guest wifi build" country=canada default-forwarding=no disabled=no distance=indoors \
frequency=auto mode=ap-bridge ssid=RRS_Guest_5G wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether10 ] comment="offbridge build" name=OFFBridge
/interface pppoe-client
add add-default-route=yes disabled=no interface=sfp-sfpplus1 name=pppoe-out1 use-peer-dns=yes user=
/interface wireless manual-tx-power-table
set wlan1 comment="guest wifi build"
set wlan2 comment="guest wifi build"
/interface wireless nstreme
set wlan1 comment="guest wifi build"
set wlan2 comment="guest wifi build"
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk comment="guest wifi build" mode=dynamic-keys supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add comment="guest wifi build" name=guest-pool ranges=192.168.99.200-192.168.99.254
add comment="subnet build" name="pool 70" ranges=192.168.70.200-192.168.70.254
add comment="subnet build" name="pool 80" ranges=192.168.80.200-192.168.80.254
add comment="subnet build" name="pool 90" ranges=192.168.90.200-192.168.90.254
add comment="l2tp config" name=l2tp-pool ranges=192.168.50.200-192.168.50.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
add address-pool=guest-pool comment="guest wifi build" interface=guest-bridge name=guest-server
add address-pool="pool 70" comment="subnet build" interface="bridge 70" name="server 70"
add address-pool="pool 80" comment="subnet build" interface="bridge 80" name="server 80"
add address-pool="pool 90" comment="subnet build" interface="bridge 90" name="server 90"
/port
set 0 name=serial0
set 1 name=serial1
/ppp profile
add comment="l2tp config" dns-server=149.112.120.20 local-address=192.168.50.1 name=l2tp-profile remote-address=l2tp-pool use-encryption=yes
/certificate settings
set builtin-trust-anchors=not-trusted
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge interface=ether1
add bridge="bridge 70" comment="subnet build" interface=ether7
add bridge="bridge 80" comment="subnet build" interface=ether8
add bridge="bridge 90" comment="subnet build" interface=ether9
add bridge=guest-bridge comment="guest wifi build" horizon=10 interface=wlan1
add bridge=guest-bridge comment="guest wifi build" horizon=10 interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set authentication=mschap2 default-profile=l2tp-profile enabled=yes use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=sfp-sfpplus1 list=WAN
add comment="subnet build" interface="bridge 70" list=LAN
add comment="subnet build" interface="bridge 80" list=LAN
add comment="subnet build" interface="bridge 90" list=LAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.69.1/30 comment="offbridge build" interface=bridge network=192.168.69.0
add address=192.168.99.1/24 comment="guest wifi build" interface=guest-bridge network=192.168.99.0
add address=192.168.70.1/24 comment="subnet build" interface="bridge 70" network=192.168.70.0
add address=192.168.80.1/24 comment="subnet build" interface="bridge 80" network=192.168.80.0
add address=192.168.90.1/24 comment="subnet build" interface="bridge 90" network=192.168.90.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=yes interface=sfp-sfpplus1
/ip dhcp-server network
add address=192.168.70.0/24 comment="subnet build" dns-server=192.168.70.1 gateway=192.168.70.1
add address=192.168.80.0/24 comment="subnet build" dns-server=192.168.80.1 gateway=192.168.80.1
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
add address=192.168.90.0/24 comment="subnet build" dns-server=192.168.90.1 gateway=192.168.90.1
add address=192.168.99.0/24 comment="guest wifi build" dns-server=149.112.120.20,149.112.121.20 gateway=192.168.99.1
/ip dns
set allow-remote-requests=yes servers=149.112.120.20,149.112.121.20
/ip dns static
add address=192.168.69.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=log chain=forward comment=troubleshooting disabled=yes log=yes src-address=192.168.50.254 src-address-list=""
add action=accept chain=input comment="l2tp config vpn access" port=500,1701,4500 protocol=udp
add action=accept chain=input comment="l2tp config allow ipsec esp" protocol=ipsec-esp
add action=accept chain=input comment="l2tp config allow ipsec ah" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="Allow established/related connections" connection-state=established,related
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=accept chain=forward comment="enable DNS using pihole server" dst-address=192.168.80.20 dst-port=53 protocol=udp
add action=accept chain=forward comment="enable DNS using pihole server" dst-address=192.168.80.20 dst-port=53 protocol=tcp
add action=accept chain=forward comment="enable DNS using pihole server replies" dst-address=192.168.70.0/24 dst-port=53 protocol=udp src-address=192.168.80.20
add action=accept chain=forward comment="enable DNS using pihole server replies" dst-address=192.168.70.0/24 dst-port=53 protocol=tcp src-address=192.168.80.20
add action=accept chain=forward comment="Allow UDP replies from Pi-hole to 70 subnet" dst-address=192.168.70.0/24 protocol=udp src-address=192.168.80.20
add action=accept chain=forward comment="Allow TCP replies from Pi-hole to 70 subnet" dst-address=192.168.70.0/24 protocol=tcp src-address=192.168.80.20
add action=accept chain=forward comment="Allow all traffic from Pi-hole to 70 subnet" dst-address=192.168.70.0/24 src-address=192.168.80.20
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="guest wifi build" dst-address=192.168.99.0/24 src-address=192.168.99.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="nat for vpn access" out-interface-list=WAN src-address=192.168.50.0/24
/ip service
set ftp disabled=yes
set telnet disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set always-allow-password-login=yes
/ipv6 firewall filter
add action=drop chain=" input" comment="ipv6 defconf removed"
add action=drop chain=forward comment="ipv6 defconf removed"
/ppp secret
add name=
/system clock
set time-zone-autodetect=no time-zone-name=
/system identity
set name=edgerouter
/system leds
add interface=wlan1 leds=wlan1_signal1-led,wlan1_signal2-led,wlan1_signal3-led,wlan1_signal4-led,wlan1_signal5-led type=wireless-signal-strength
add interface=wlan1 leds=wlan1_tx-led type=interface-transmit
add interface=wlan1 leds=wlan1_rx-led type=interface-receive
/tool graphing interface
add disabled=yes interface=bridge
add disabled=yes
add interface=sfp-sfpplus1
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
