Two Networks Two DNS Policies - Securing Trusted and Guest Devices at Home

Published November 02, 2026 • Updated November 02, 2026

A home network does not need to treat every connected device equally. In fact, separating trusted personal devices from guest devices — particularly company-managed laptops — is a sensible way to improve security without making everyday network management unnecessarily complicated.

My approach uses a GL.iNet Beryl 7 router for DHCP and network separation, Pi-hole for trusted devices, and Quad9 for guest DNS resolution.

The result is a network that combines detailed visibility and ad blocking for personal devices with isolation and additional DNS security for devices outside my control.

The trusted network: Pi-hole

My main home network uses Pi-hole as its DNS server. The Beryl 7 distributes Pi-hole’s IP address to devices through DHCP, ensuring that their DNS queries go directly to Pi-hole.

This provides several advantages:

• Ad and tracker blocking: Pi-hole filters requests to known advertising, tracking and other unwanted domains across the network, without requiring individual browser extensions.
• DNS visibility: The query log provides detailed insight into which domains individual devices are accessing, making it easier to identify unusual DNS activity or investigate unexpected connections.
• Local DNS resolution: I can assign meaningful names to devices on my network rather than remembering their IP addresses. For example, I can use ssh mylaptop instead of remembering a numerical address (assuming the local DNS search domain is configured appropriately).
• Centralised management: Filtering rules, allowlists, blocklists and local DNS records can all be managed centrally.

An important distinction is that Pi-hole provides DNS-level visibility, not a complete inspection of all network traffic. Nevertheless, it is an extremely useful source of information about what devices are trying to reach.

The guest network: isolation and Quad9

The guest network serves a different purpose. For example, I have a company-issued laptop connected to my home network. Although I have no particular reason to distrust the device, it is managed by another organisation. I do not control its security policies, software, endpoint protection or configuration. I therefore prefer not to give it the same access or visibility as my personal devices.

The Beryl 7 provides a separate guest network with AP isolation enabled. This prevents guest devices from communicating directly with one another. The guest network is also kept separate from the trusted home LAN, with appropriate firewall restrictions preventing access to personal devices and services.

Rather than advertising Pi-hole as the guest network’s DNS server, I leave the guest DHCP DNS fields empty. The intention is for guest clients to use the Beryl’s own DNS forwarding service. The router is configured to use Quad9 with DNS-over-HTTPS (DoH) as its upstream resolver.

This provides an additional layer of protection:

• Malicious domain blocking: Quad9 blocks known domains associated with malware, phishing, ransomware and other threats.
• Encrypted DNS: DNS requests forwarded from the Beryl to Quad9 are encrypted using HTTPS, making them harder for an ISP or other network intermediary to inspect or manipulate.
• DNSSEC validation: Quad9 validates DNS responses to help protect against certain forms of DNS manipulation.
• Privacy: Quad9 operates a privacy-focused DNS service and states that it does not retain end-user IP addresses.

Unlike Pi-hole, Quad9 does not aim to block general advertising or tracking domains. Its focus is security-related DNS filtering.

Advantages of this arrangement

The main benefit is that devices receive a level of network access appropriate to their trust level.

For trusted personal devices, I retain the advantages of Pi-hole: network-wide ad and tracker filtering, individual client visibility, detailed DNS query logs and convenient local hostname resolution.

For guest devices, I gain isolation from my personal network while still providing a security-conscious DNS service. They can access the internet without needing access to Pi-hole, NAS devices, SSH services or other resources on my home LAN.

There is also a useful separation of responsibilities. Pi-hole handles customised filtering and visibility, while Quad9 provides security-focused DNS resolution for the guest network.

Disadvantages and limitations

Less visibility into guest devices: Because guest DNS requests do not pass directly through Pi-hole, I lose Pi-hole’s individual client query history for those devices. I cannot easily see which domains the company laptop is requesting through the Pi-hole interface.

No general ad blocking on the guest network: Quad9 concentrates on malicious domains rather than advertising and tracking. Guest devices therefore do not benefit from the same filtering as personal devices.

DNS filtering is not comprehensive security: DNS-based protection only works when applications use the configured resolver. A corporate VPN, independently configured encrypted DNS service or hardcoded IP address can bypass the router’s DNS filtering. Quad9 also cannot prevent every type of malicious connection or replace endpoint protection.

Reduced access to local services: Guest devices cannot use the trusted network’s local DNS records or access its internal services. This is intentional, but it can occasionally be inconvenient.

It is also worth remembering that DNS-over-HTTPS only encrypts the DNS connection between the router and Quad9. It does not encrypt all internet traffic or replace a VPN.

Conclusion

I prefer this arrangement because it avoids treating every device on my home network as equally trustworthy.

My personal devices benefit from comprehensive DNS-level visibility, local name resolution and network-wide ad and tracker blocking through Pi-hole.

Guest devices, including company-managed laptops, receive a separate network with restricted access to my home infrastructure and security-focused DNS resolution through Quad9 over HTTPS.

It is a relatively simple configuration, but it provides a sensible balance between convenience, privacy and security. The underlying principle is straightforward: trusted devices get visibility and access; guest devices get isolation and only the services they need.

Appendix

Additional Considerations – Isolation and Good Home Network Security Practices

Network isolation is about more than simply keeping personal devices separate from guest Wi-Fi. It is also an important measure of protection against the spread of security incidents.

For example, if a company-issued laptop were compromised by malware, ransomware or another threat, network isolation helps prevent that incident from spreading to personal computers, NAS devices, servers and other resources on the home network. Equally, should a personal device become compromised, appropriate guest network isolation helps prevent that device from directly accessing company-managed equipment. Neither network should implicitly trust the other.

This is particularly relevant when working remotely. Employers invest heavily in endpoint security, monitoring and device management, but these systems should not be the only line of defence. Employees can play an important role in protecting company assets by understanding the risks of their home network and taking reasonable steps to reduce them. Simply relying on an employer’s endpoint protection does not remove the responsibility to practise good network hygiene.

There is also a wider professional consideration. Someone who takes the time to segment their home network, restrict access between trusted and untrusted devices, manage DNS security and understand the implications of network exposure demonstrates a practical awareness of cybersecurity principles. These are not merely theoretical concepts; they reflect an understanding of how to protect systems and data.

In fact, the underlying approach is closely aligned with enterprise network security: network segmentation, access control, least privilege and defence in depth. Obviously, a home network operates on a much smaller scale and does not require the complexity of an enterprise environment. Nevertheless, the fundamental security principles are the same.

Good home network security is not simply about protecting personal equipment. For anyone working remotely, it is also a practical contribution to protecting their employer’s systems, information and assets.