I have an AirPort Extreme and Express which provide a guest and a private wireless network. I also have a Mac server ( running on the LAN. I want that server to be accessed only on the private wireless network.

I want the hostname of the Mac server to resolve to on the private wireless network instead of resolving to my external IP address. This means that DHCP clients on the private network need to have as the primary DNS server and as the secondary DNS server. The clients on the guest network on the other hand need different DNS servers (eg. and

How can I configure these settings separately for the private and guest network on the AirPort Extreme and Express?


What you are suggesting will provide name resolution to the 192.168.1 subnet but has nothing to do with restricting access.

The correct way to do what you want is to firewall the device, or have no routing between your subnets.

If you do want to set up just the DNS settings then all you have to do is propagate them via DHCP. This means having two separate DHCP scopes, one with the google DNS servers, and one with your internal DNS server.

  • Yes, they are in a different IP range. Apple takes care of that: the guest network is on different VLAN than the private network. So there already is no routing between the subnets. So if I set as the primary DNS the guest clients fail to connect to the server, obviously. That's why I want to change the DNS settings per network. Is it possible to have two separate DHCP scopes on an AirPort Extreme or Express? – Stan Dec 19 '13 at 15:07
  • DNS and routing are separate issues, setting the DNS to will have no impact. If your two subnets are on a different VLAN then you already have two separate DHCP scopes, and all you need to do is change the DNS being pushed out. – Deesbek Dec 19 '13 at 15:28
  • Okay, thanks. I configured the DNS servers of the AirPort Extreme to and, nslookup google.com works, but nslookup google.com doesn't. Guest computers get as their only DNS server, but nslookup google.com doesn't work either. What's happening? – Stan Dec 19 '13 at 20:17
  • Where is 1.1 coming from? is your wifi 172.16? I will be in chat if you want to discuss further. – Deesbek Dec 19 '13 at 20:31
  • I'm sorry, 1.1 is the Airport Extreme itself. I noticed the DNS settings in the Airport Extreme are only applied to the private network ( and the guest network ( gets as the DNS server, which is the Airport itself. But the Airport doesn't respond to nslookups. – Stan Dec 19 '13 at 21:15

What you could do is set-up your airports extrem/express to use just the Google's DNS.

And for your local peripheral you modify the network settings, you can still keep DHCP but you override the DNS settings and put first your Mac Server and second the Google DNS. If you are a home user with a few devices, that should not be too much manual work.

  • Yes, but I'm not a home user; I use the same computer at my office. Thanks, but this isn't a solution for me. – Stan Dec 19 '13 at 15:04

If you are unable to configure seperate settings for the DHCP server to hand out differnt DNS info to the different networks (which you cannot do with Apple's standard Airport Utility), I THINK that telling the Airport that the DNS servers are and (or your ISP's DNS server) will mostly have the effect that you want:

  1. Your local devices will use since that will respond quickest.

  2. Devices on the "guest" network may try to connect to but since it won't respond, they will go to for their information.

This type of setup is not ideal, since it is possible that your local devices won't be able to talk to other local devices if they somehow are using the server which doesn't know about names on your private network - but that should be a rare event since the local DNS server should be preferred by local clients as it generally would be faster. The "guest" devices might experience some lag if they are continually waiting for a non-responsive connection to before trying, but I think most devices will locally cache results for things that they have recently looked up and they may preferrentially use once it is found to be faster than the unreachable

This response bascially says the same thing: https://discussions.apple.com/message/24330741#message24330741

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .