Thanks for the answer. But it does not contribute to anything. In the above doubts. It just reports that it works, but it does not know how it works. I will continue researching and I will not give up for answers like this. thank you

Yes.

Look at that, the first entry under options in the help screen.  Ug, when will I learn to actually read those screens when they flash by my eyes…

"10.0.0.0/16 tunnel" WTF why would you need such a large tunnel for a site to site connection??  Why would you ever need such a tunnel??  For site to site /30 would be all you would need. "172.16.0.1, and that pfsense box will query 10.0.0.1 " Why would it do that??? "needs to translate from 172.16.0.0 to 10.0.0." Why??? This would be your typical setup.. See attached. So you want the main site dns and dhcp to to provide dns for the remote site?  Then you would setup dhcp relay on the remote site to point to your dhcp server.  As for DNS.. You would either point your clients directly to the dns server on 172.20.0/24 or you could have your clients ask the remote site pfsense for dns.  And then use a domain override to ask the main site dns for whatever domains its authoritative for, or you could just have pfsense do a forward for all dns to it.. Comes down to what exactly do clients want/need to resolve from there? Or you could just have the remote site pfsense hand out dhcp and not have to worry about the relay. I am at a loss to understand why you think you need to translate from rfc1918 to rfc1918 and why pfsense on your remote site would need to forward or use for dns the IP address in your tunnel? [image: typicalsetup-site2site.png] [image: typicalsetup-site2site.png_thumb]

How many threads you going to create for this topic? https://forum.pfsense.org/index.php?topic=126008.0

"How should I connect with https to the switch?" To what switch and from where?  Your smart switch?  If you want to manage this switch from your lan connect a vlan to your lan.  Why would you not just create a SVI on whatever vlan you want and connect that to your lan? The whole point of a smart/managed switch is to created different layer 2's in the same physical switch.  Ie bunch of switches inside 1 physical switch..  Vlans can be tagged or untagged.

Yep, I think that's the direction I'm gonna head as well.  No proxy and set up pfBlockerNG to take over the DNS filter duties from pi-hole.

Nope, no such thing. BIND with views perhaps.

I am at a loss for words. Glad and upset with myself at the same time. Can't believe I did not try that. It absolutely worked. DHCP is up and running on all the VLANs. Thank you

Perhaps post the DHCP logs.

And it's back!

@Jon: @Tomko: That's great. Thanks. Let me know if you find any issues. $ dig xyxyxy.freemyip.com ; <<>> DiG 9.11.0-P2 <<>> xyxyxy.freemyip.com .... ;; ANSWER SECTION: xyxyxy.freemyip.com.    60      IN      A      1.2.3.4 Nice  8) After testing it the whole last week, I'm confident that it works pretty well now. It's now officially added to the Help section, and as usual I credited you in the What's New section :) I'm now looking into implementing support for different IPs per subdomain, as what bimmerdriver asked for. It's a bit tricky and there are quite a few edge cases that I need to account for it, so it might take a while to implement, but so far it looks like I will be able to do it. I'll let you guys know once that is ready for testing. Thanks, Tom