Hello Jon,
Thanks for your advice.
In this case, the issue is not with pi-hole at all. It is working fine behind OpenWrt, OPNSense routers. I have been using it for many years.
The issue is to allow me to make a decision about which DNS server, and in which fashion (with or without DNSSEC), the IPFire router access DNS. It seems to be out of the hand of the admin of IPFire, sort of like baked into the software.
I did read the posts you pointed me to. Although they are not quite relevant to my use-case (as my current issue is not having 2 subnets to be using pi-hole).
Altough the first post states that pi-hole works perfectly on the wired network, I suspect that is because of the use of managed switches. If not, I wish I knew how this was setup as that is my first issue.
To satisfy using pi-hole on two differents subnets/VLAN which I will look after I succeed in getting pi-hole to work on one subnet, I suspect it may be resolved by pinholing from one zone to another.
If it is the case that pi-hole cannot be used with IPFire, regretfully then, IPFire is not a valid solution for my use case and I will go back to OPNsense or OpenWRT.
Thanks again,
Michel