Networking – How to block specific sites on Asus wifi router

If you consider the LAN/WLAN side of the primary router (that is, the network segment(s) between the primary router and the secondary router) to be part of "the local network" that the Guest Network devices should not have access to, then a secondary router cannot provide Guest Network access only to the Internet without cooperation from the primary router.

The Guest Network's traffic to/from the Internet has to cross the same link between the two routers as local network traffic. But if you want it segregated from the local network, it has to be tunneled or tagged in some way that segregates it from the local network traffic. But if that traffic is segregated through, say, VLAN tagging or some kind of higher-layer tunneling, the primary router needs to know how to do the right thing with that traffic (that is, decapsulate it and send it only to the Internet, and not let it route back onto the LAN).

I don't know if any Netgear equipment has support for this kind of "Guest Network Extension" functionality, where the primary router acts as a VLAN-aware device or tunnel endpoint so that secondary routers can forward segregated Guest Network traffic to it.

I know that Apple AirPort Extreme/Express/Time Capsules as of firmware 7.6.3 support this. If you have an Apple AP as your primary router (in NAT mode), and have Guest Network enabled, and another Apple AP as your secondary "router" (actually in bridge mode, not really being a "router" per se), also with Guest Network enabled, then the secondary AP will forward Guest Network traffic toward the primary AP, but will VLAN tag it so it's segregated from local LAN traffic. The primary AP also subscribes to the same VLAN, and knows to forward traffic from that VLAN to the Internet, but not back onto the local LAN.

q1) Will my workstation still try to resolve "host1" by sending a dns query to the DNS server (e.g. 192.168.1.1) ?

host1 is a NetBIOS entry but not a DNS entry, DNS entry should have a doamin and a extension parameters.

q2) In the DNS server, will this query be accepted ? or fall into/being look up in any default zone (e.g example.com) ?

If DNS server gets NetBIOS request usually this will fail because it don't have a extension.

Is there anyway that i can configure my DNS server to have a default zone that is being lookup for unqualified name (e.g. host1)

On internet connection settings you can configure DNS suffix, hence host1 will be auto suffexed with the domain.local before this reach DNS server.

Hence DNS server should receive this as host1.domain.local --> this will solve the issue.