Hi, 

i personally used an old router to do this. My old router is configured to assigned a new ip (which is a different subnet from my ISP and my LAB) and from there I called my (VM) PiHole DNS and DHCP. Or if your PiHole device has multiple eth ports, enable the dhcp in PiHole the forward the traffic to the second ports… why I don’t have Eero as Main router… only 2 forking ports on it… and I need at least 5ports… also their is no possibility to manually configure the security on it… their knowledge seems a bit weak on this point. Here’s my Visio for my home configuration. Will be updated this summer with 2.5gbe switches and router.