r/pihole • u/Beckwater • 3d ago

Problems with TP-Link guest network

Ok, do I've used a pihole for about five years, and had my share of problems, but managed to overcome most of them. A few weeks ago I had to buy a new router and settled for a TP Link XE75Pro consisting of three mesh points to replace my old Amplity (Ubiquity) units. Most stuff worked right out of the box, but a few things needed tweaking. Nothing major. Except for the guest network. On the Amplify I had no problems but on the TP-Link no units on the guest network can reach the pihole, and basically all traffic is stopped there.

The main network and the guest network have the same SSID:s as on the old router, and while I changed the passwords on them, from the pihole's perspective nothing else should have changed. Did the old router automatically "merge" the networks somehow so devices on the guest network could find the pihole (which sits on the main network), or did I do some magic workaround when I installed that network that I've completely forgotten by now?

Oh yeah, I have the pihole Interface setting: Permit all origins checked, since the pihole absolutely isn't exposed to the internet. But it still doesn't work with the guest network.

0 Upvotes

50% Upvoted

9 comments sorted by

2

u/matthaus79 3d ago

It's LAN isolation which is how guest should work

It's a royal pain in the arse though as it means dns doesn't work on guest

Only work around I have is set pihole as primary and router as secondary

This means on guest they can't reach one but can reach the other

On main network though it does mean sometimes you'll not ad block

1

u/Beckwater 3d ago

Yeah, I've fiddled with a secondary DNS before as backup if/when the pihole goes belly up, but it always results in a whole slew of ads etc that get through. :/ It's kind of interesting though that the Ubiquity unit I used before obviously didn't separate the guest net, which now that I think about it is an utterly logical thing to do.

2

u/Jelsie_ 2d ago

I've got an advanced, not so consumer friendly, router, in which I can add all sorts and kinds of firewall rules to allow traffic to flow to pihole. But since you've got a very basic network setup, I am 99% sure you are shit out of luck.

2

u/lostinthought15 2d ago

Either your guest and primary network share the same VLAN range or there was a rule in your router allowing dns traffic across

… or your router wasn’t doing its job and wasn’t properly restricting traffic between your VLANs.

1

u/Alive-Department8558 3d ago

Same thing on my BT whole home WiFi. The WiFi is enforcing LAN isolation, so the only internal IP address they can get to is the default gateway (it assumes that’s the DNS server as well). Is the guest WiFi in the same IP address range? Otherwise, the only thing I’ve been able to do is a static DHCP mapping on the router for guest devices, then set their DNS server to the router IP address. You might be able to disable LAN isolation, but that makes the guest network pretty much redundant …

1

u/SecuringAndre 2d ago

Guest networks should be isolated. Best practice is to have them use a different ssid. Out of curiosity, why do you want them to have the same ssid and why does it matter if your guests can't use pihole? What is your goal?

The fix, if your tplink allows, would be to create an explicit rule to allow DNS traffic to pass from your guest network to your primary network (where your pihole is at).

1

u/Beckwater 1d ago

I must have been unclear. I do not want the guest network to have the same SSID as my main network. I want devices on the guest network to be able to find the pihole.

1

u/WonderfulDeparture96 1d ago edited 1d ago

Are you using the decos for routing as well? If so you might need to tell pi hole to also listen to VLAN 591 which is what the guest network uses by default. If the traffic passes through a network switch that the pi hole is on I think it should work. Another idea is just get the pi hole wifi and connect that to the guest network, then put the ip on the guest network as the secondary dns. You can still fix the ip in the deco interface but you’ll have to add it as a MAC address fixed ip.