{...}: {
  networking.firewall.checkReversePath = false;
  networking.firewall.allowedUDPPorts = [67]; # allow dhcp request

  services.dnsmasq = {
    enable = true;
    settings = {
      interface = [
        "vlan101" # network
        "vlan102" # iot
        "vlan104" # media
      ];

      no-resolv = true;
      no-poll = true;

      server = [
        "1.1.1.1"
        "9.9.9.9"
      ];

      dhcp-authoritative = true;

      dhcp-host = [
        # vlan101
        "18:e8:29:c6:29:84,ap-caro,10.0.42.21" # ap-caro
        "e4:38:83:e7:00:10,ap-hendrik,10.0.42.22" # ap-hendrik
        "e4:38:83:e7:0a:c4,ap-wohnzimmer,10.0.42.23" # ap-wohnzimmer

        # vlan102
        "38:1a:52:04:37:d8,printer,172.16.0.15" # printer

        "3c:e9:0e:87:d2:1c,nspanel-hendrik,172.16.0.21" # nspanel_hendrik
        "3c:e9:0e:87:ef:d0,nspanel-schlafzimmer,172.16.0.22" # nspanel_schlafzimmer
        "98:0c:33:fe:3d:a8,nuki-wohnung,172.16.0.23" # nuki_wohnung
        "c8:5c:cc:5c:54:06,presence-wohnzimmer,172.16.0.24" # presence_wohnzimmer
        "c8:5c:cc:5c:28:7b,presence-hendrik,172.16.0.25" # presence_hendrik
        "04:78:63:7f:0e:bb,airpurifier-wohnzimmer,172.16.0.26" # airpurifier_wohnzimmer
        "48:e7:29:c1:a3:f0,nspanel-caro,172.16.0.27" # nspanel_caro
        "5c:c5:63:eb:e8:b8,poffertjes,172.16.0.28" # poffertjes
        "d0:ba:e4:e7:7d:d5,airpurifier-hendrik,172.16.0.29" # airpurifier_hendrik
        "98:f4:ab:f2:43:98,shelly1-flur-deckenlicht,172.16.0.30" # shelly1 flur deckenlicht
        "a4:cf:12:ba:72:c1,shelly25-abstellraum,172.16.0.31" # shelly25 abstellraum
        "c8:2b:96:11:10:46,shelly25-badezimmer,172.16.0.32" # shelly25 badezimmer
        "24:62:ab:41:06:f2,tasmota-tv-steckdosenleiste,172.16.0.33" # tasmota-tv-steckdosenleiste

        # vlan104
        "30:58:90:1a:3b:ef,box-hendrik,10.42.0.21" # box_hendrik
        "30:58:90:19:b5:03,box-schlafzimmer,10.42.0.22" # box_schlafzimmer
        "30:58:90:28:7e:30,box-esstisch,10.42.0.23" # box_esstisch

        "1c:53:f9:23:d7:c4,nh-hendrik,10.42.0.31" # nh_hendrik
        "1c:53:f9:14:7b:65,nh-kueche,10.42.0.32" # nh_kueche
        "1c:53:f9:1c:9e:22,nh-wohnzimmer,10.42.0.33" # nh_wohnzimmer
        "20:1f:3b:96:9f:29,nm-schlafzimmer,10.42.0.34" # nm_schlafzimmer

        "6c:ad:f8:73:a0:94,cc-wohnzimmer,10.42.0.41" # cc_wohnzimmer
      ];

      dhcp-range = [
        "vlan101,10.0.42.51,10.0.42.100"
        "vlan102,172.16.0.101,172.16.0.150"
        "vlan104,10.42.0.51,10.42.0.100"
      ];

      dhcp-option = [
        "option:dns-server,1.1.1.1"
        "option:mtu,1460"

        # vlan101
        "vlan101,option:router,10.0.42.1"

        # vlan102
        "vlan102,option:router,172.16.0.1"

        # vlan104
        "vlan104,option:router,10.42.0.1"
      ];
    };
  };
}