Forums

Stories

Knowledge Base

Home Network Community > Deco > Deco M5 Guest Network Isolation issue

< Deco

Deco M5 Guest Network Isolation issue

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Deco M5 Guest Network Isolation issue

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

will_r

LV1

2021-04-26 10:44:57 - last edited 2021-04-26 15:14:21

Posts: 3

Helpful: 0

Solutions: 0

Stories: 0

Registered: 2021-04-25

Deco M5 Guest Network Isolation issue

2021-04-26 10:44:57 - last edited 2021-04-26 15:14:21

Model: Deco M5

Hardware Version: V1

Firmware Version: 1.53

Hello everyone,

I have an interesting problem I'm trying to solve.

I have a deco m5 system running in AP mode (router mode doesn't offer the functionality I need). It works well, reasonably good handover, and coverage of my home.

However one thing that isn't working is the guest network isolation.

If I turn on network isolation there's no internet access, if I turn off isolation guest network has internet access. Now I do want to have the guest network isolated - so I must try and fix this.

I know why it isn't working but I can't work out how to solve it at the moment I need some external brain power.

The issue is I use pihole to manage my DNS and avoid ads and tracking etc... It's brilliant.

If I turn on network isolation on the guest network it can no longer access the DNS server. I can ping external addresses but it cannot resolve them. So somehow I need to bring the pihole into the "guest" network but I can't workout how to do it on the deco.

If I turn off pihole and just use my router as the dns server there's no issues at all, but it's one of these things I'd like to solve if possible!

Here's a copy of my network if that's of any use (it's simplified ,the full network map has too much personal detail in it!).

So my question, can the deco be accessed to add some routing to it?

1 Accepted Solution

Alexandre.

LV6

2021-04-26 13:59:33 - last edited 2021-04-26 15:14:21

Posts: 3466

Helpful: 1963

Solutions: 416

Stories: 0

Registered: 2020-10-22

Re:Deco M5 Guest Network Isolation issue-Solution

2021-04-26 13:59:33 - last edited 2021-04-26 15:14:21

@will_r

>So somehow I need to bring the pihole into the "guest" network but I can't workout how to do it on the deco.

You can't add routing in Deco that runs in Access Point mode, but there is different solution.

What you have when network isolation enabled is two separate networks:

1) Network A (wired devices and wireless devices on "main") with its own wired DNS server (a.k.a. pihole);

2) Network B (wireless devices on "guest") without DNS server.

Devices on Network A can resolve host names. Devices on Network B can't resolve host names.

If you look at it this way, solution presents itself: you need another DNS server, and you need it on Network B. It could be carbon copy of DNS server on Network A, but it must belong to Network B.

Which means, you'll need to also connect pihole wirelessly to Deco mesh and point wirelessly connected devices to that pihole as their DNS server.

That could require separate piece of hardware to run second pihole, but perhaps your (Linux?) box you run pihole on has WiFi interface. If yes, you'll need to research how to have your specific flavour of Linux connected to network on both interfaces (WiFi, Ethernet) simultaneously, and how to make DNS service running on it respond to DNS queries coming from both interfaces.

When configured properly, you may be able to utilize single Linux box to service DNS queries from wired devices, "guest" and "main" Deco WiFi networks.

You will need to configure your home network DHCP server (on ISP router?) to return two IP addresses for DNS servers: one from wired connection and one from wireless connection of pihole server(s). Each device on your network will be able to access one of these two IP addresses, thus getting DNS queries resolved successfully.

You should make these two IP addresses static, of course, it can be done on ISP router.

Done.

Recommended Solution

3 Reply