try netbird + pihole

system/services/containers/netbird/default.nix

@@ -35,6 +35,11 @@
             firewall = lib.mkIf config.sysconfig.virtualization.netbird.enable {
                 allowedUDPPorts = [ 3478 ];
                 allowedUDPPortRanges = [{ from = 51100; to = 56100; }];
+
+                interfaces."ve-netbird" = {
+                    allowedTCPPorts = [ 53 ];
+                    allowedUDPPorts = [ 53 ];
+                };
             };
             nat.internalInterfaces = [ "ve-netbird" ];
         };