I’m setting up a homelab and I’m trying to figure out where the optimal location for the DNS and DHCP server (PiHole) is. The network is structured like this:

Network Diagram

The majority of devices on the network are connected via WiFi (Phones, laptops, TV, smart home devices etc...).

Where should I place the DNS and DHCP device and why?

  1. Plugged into the ASUS router?
  2. Plugged into the layer 2 switch?
  3. Host it on the NAS?

⚠️ The Xfinity modem is actually a modem/router device with WiFi disabled (xFi Advanced Gateway XB6)

  • 2
    Usually your home router (the ASUS) has these services built-in. Are you interested in overriding them for some customized purpose (e.g. pi-hole)?
    – user253751
    Aug 3 at 12:32
  • @user253751 Yes. I plan to have the DNS and DHCP services turned off on the router and point to the device that runs them (most likely as a container on the NAS). There is basically no DNS configuration on that router and DHCP is somewhat lacking as well.
    – Xkonti
    Aug 7 at 5:55

4 Answers 4


I think the 'easiest' way is to think of them as seperate services. It doesn't actually matter where they are as long as the network segment's the same one.

"By default" - your asus router does 4 things. It acts as an AP, it acts as a firewall (which you want to retain - passing data from the wan), it does DNS and DHCP. These don't 'need' to run on the router. However if you're not using it on the router, you turn it off (but I think you know this already)

As long as there's a server doing DHCP and DNS the other systems should pick it up. I'd suggest running the pihole as a separate device rather than on the cluster, cause sometimes its difficult to bring up a container or vm cluster if it depends on dhcp or dns its hosting itself. As such either connecting it to the router or switch should be fine. You don't need much bandwidth so the 2.5Gbps vs 10 gig should be fine.


PiHole is just a software suite, among others they have an official Docker image - just plop that into your K8S on the NAS.

SD cards are... not really meant for the kind of storage you'd run your OS off of. In the Pi they are mostly a roulette - will it work, or will it go down? Taking down your DHCP means a lot of devices won't be able to use the network. A container on a system like the QNAP NAS will be much more stable and have much less risk.

If you have a device which is not the Pi - say, an SBC running of eMMC or a different home server - then running the DHCP there will be a better option, as Journeyman explains. Just, please, not something that's running off of an SD card.

  • Agreed, with the caveat you can get high-endurance SD cards specifically designed for this kind of workload. That, plus a few extra steps for minimal logging when setting up the pi and you're likely to end up with a long-running and stable system. Aug 3 at 17:53

Ideally you have the ASUS router in Access point mode and reverse it with the switch, where wifi is just one more service provided by the network. The pihole DHCP/DNS will also connect to a port on the switch, and the DHCP service will provide the internal IP of the modem as the default gateway for your network.

This reduces the number of points of failure. You can lose the ASUS router, and wired devices on the network will still have full service. Combine this with the suggestion to run the pihole image on the NAS, and you gain even more resilience (and get your switch port back).

  • That's an interesting idea with switching the ASUS router into the access point mode. Does it mean that I would need to connect the Xfinity modem directly into the switch? The Xfinity modem is really a router where I disabled the WiFi. There were issues with it and I'm not sure if plugging it directly to the switch would allow Xfinity to snoop on the home network.
    – Xkonti
    Aug 7 at 5:58
  • 1
    Yes, it means connecting the xfinity directly to the switch. Your ISP already sees your traffic, so it's unlikely the xfinity is doing anything else to snoop. Aug 7 at 22:00

Between the Xfinity and ASUS router. However, it's the logical location that is important. I use a unify router for DHCP at and PiHole at And the DHCP points to the PiHole as a primary DNS.

  • 1
    Then you have to deal with having something outside of "your part" of the network (which ends at the ASUS router) and you probably don't have an IP address for it so you have to take special measures to make sure it's only visible from "your part" and... ugh
    – user253751
    Aug 3 at 12:42
  • That depends on how the xfinity and asus are configured. So you could be right. Aug 3 at 12:49
  • Oh yeah, I'm making an assumption based on the labels "modem" and "router"
    – user253751
    Aug 3 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.