Pi-hole answered one VLAN and ignored the rest

$ cat summary

Pi-hole lives on my server VLAN, and the router hands it out as the DNS server to every VLAN. Clients on other VLANs could ping it, but their DNS queries timed out. Pi-hole was rejecting queries from other subnets, and once that was fixed, the router's ACLs were dropping its replies.

$ cat investigation

Ping working ruled out routing. Something was blocking DNS specifically. Pi-hole's log said it directly:

ignoring query from non-local network

By default Pi-hole only answers clients on its own subnet, as a safety net in case it ends up exposed to the internet. Every other VLAN counts as "non-local", so their queries were dropped.

After I changed that, queries from the Guest VLAN showed up in Pi-hole's log as answered, but the clients still timed out. Pi-hole was replying and the replies weren't arriving. The router's ACLs between VLANs are stateless: they don't remember that a query went out, so the reply is judged as new traffic in the other direction. My rules allowed the query and blocked the answer.

$ cat fix

• Pi-hole: set the listening mode under Settings → DNS → Interface settings to accept queries from all origins. That's only safe because Pi-hole isn't reachable from the internet. My network has no inbound ports at all.
• ACLs: added a rule for each direction. Clients can reach Pi-hole on port 53, and Pi-hole's replies on port 53 can get back. Everything else between those VLANs stays blocked.

$ cat lessons

• Ping isn't proof. It shows the route works, not that a specific port or service does.
• Stateless means both ways. With ACLs that don't track connections, every allowed flow needs a matching rule for the return traffic.
• Fix one layer, test again. The second problem only showed up once the first one was gone.