@Paul-2 The EAP225-Outdoor cannot be configured as a WiFi<-->Ethernet bridge, but there are plenty of other devices out there that can. I know the Netgear AC750 capable EX3700 (<$30 on Amazon.com)...

@zanond Please see their FAQ video here, particularly Section 4 (around 3:30 into video). https://www.youtube-nocookie.com/embed/Xv5d-wYs2Yk Obviously, in your case your 'departments' are Guest VLAN...

@C3ITUK In the definition of the LAN subnet used across the VPN, there is an option to add a DNS domain name. Did you do this? (Settings->Wired Network->LAN)

@Fae don't agree that above is the Recommended Solution. This issue can be tracked to firmware on the ER605 and so the Controller shouldn't make an impact on that.

I was mistaken, this looks like it should work on the Router's ACL creation... 1. create the DNS_Requests group 2. create a version that is PERMIT to the Safe DNS IP or IPs (create SafeIP_Group) 3....

@borgph Would I be correct in assuming your architecture has the LAN ports of the Main, ER605 and OC200 all at the same level, and that you have different WAN connections for the Main and ER605...