OpenWrt + AdGuard Home + HTTPS-DNS-Proxy fallback while preserving per-device visibility?

Hi everyone,

I'm trying to achieve the following setup on my home network:

– OpenWrt: "192.168.1.1"

– Debian 13 home server: "192.168.1.10" (HP EliteBook 2570p)

– AdGuard Home (Docker, host network): Primary DNS on "192.168.1.10:53"

– https-dns-proxy: Running on OpenWrt at "127.0.0.1:5053", providing AdGuard Family Protection as a fallback.

Currently, OpenWrt's dnsmasq forwards DNS requests to AGH, with "https-dns-proxy" configured as a fallback. This works, but AGH sees every client as "192.168.1.1" (OpenWrt) instead of the individual device IPs.

I want to keep dnsmasq's automatic fallback mechanism (without using multiple DNS servers in DHCP), while also having AGH identify each device separately so I can configure individual clients and apply different filtering policies.

I tried the “Add requestor MAC” option in dnsmasq, but I'm not sure whether AGH can use that information to identify clients.

Is there a reliable way to achieve both goals simultaneously?

Any advice or working examples would be greatly appreciated!