diff --git a/inventories/z9/host_vars/z9-router.yaml b/inventories/z9/host_vars/z9-router.yaml
index c9d2b6fd..2cd3ee14 100644
--- a/inventories/z9/host_vars/z9-router.yaml
+++ b/inventories/z9/host_vars/z9-router.yaml
@@ -3,5 +3,8 @@ systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z
 nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/z9-router/nftables/nftables.conf') }}"
 ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin"
 ansible_pull__timer_randomized_delay_sec: 0min
-unbound_access_control: [ "10.89.208.0/20" ]
+unbound_access_control: [ "10.89.208.0/20", "2a07:c481:1::/48" ]
+deploy_systemd_resolved_config__enable: false
+deploy_systemd_resolved_config__dns:
+  - 127.0.0.1
 kea_dhcp__include_vars: resources/z9/z9-router/kea_dhcp.yaml
diff --git a/resources/z9/z9-router/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf
index e59e5bda..5e5716ae 100644
--- a/resources/z9/z9-router/nftables/nftables.conf
+++ b/resources/z9/z9-router/nftables/nftables.conf
@@ -1,4 +1,5 @@
 #!/usr/sbin/nft -f
+flush ruleset
 
 ## Variables
 
@@ -6,9 +7,8 @@
 
 
 # Interfaces
-#define if_netwan = "netwan"
 define if_netlan = "netlan"
-define if_wg56_management   = "wg56"
+define if_wg56_management = "wg56"
 define if_netwan_400_fux_uplink = "netwan.400"
 define if_netlan_51_clients = "netlan.51"
 define if_netlan_52_iot = "netlan.52"
@@ -29,7 +29,6 @@ define v4_nat_ifs = { $if_netlan_51_clients,
 
 
 ## Rules
-
 table inet reverse-path-forwarding {
     chain rpf-filter {
         type filter hook prerouting priority mangle + 10; policy drop;
@@ -49,7 +48,7 @@ table inet host {
         ct state invalid drop
         ct state established,related accept
 
-		    ip protocol icmp accept
+        ip protocol icmp accept
         # ICMPv6
         # https://datatracker.ietf.org/doc/html/rfc4890#autoid-24
         # Allowlist consisting of: "Traffic That Must Not Be Dropped" and "Traffic That Normally Should Not Be Dropped"
@@ -79,7 +78,7 @@ table inet host {
         iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access"
 
         # Allow DNS server access from lan_ifs
-        iifname { $lan_ifs, $if_wg56_management } udp dport 53 accept comment "allow dns server access from lan_ifs"
+        iifname { $lan_ifs, $if_wg56_management } meta l4proto { tcp, udp } dport 53 accept comment "allow dns server access from lan_ifs"
     }
 }
 
@@ -103,7 +102,7 @@ table inet forward {
         ct state established,related accept
 
         # Allow internet access.
-		    iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access"
+        iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access"
 
         # Allow access to exposed networks from internet.
         meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
@@ -111,5 +110,9 @@ table inet forward {
 
         # Allow clients and management to most
         iifname { $if_netlan_51_clients, $if_netlan_55_management, $if_wg56_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces"
+
+        # Fux PVE backups
+        ip6 saddr { 2a07:c481:0:1::/64 } ip6 daddr { 2a07:c481:1:36::15/128 } accept comment "allow Fux PVE to access CCCHH PBS"
     }
 }
+
diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev
deleted file mode 100644
index 74bd182d..00000000
--- a/resources/z9/z9-router/systemd_networkd/10-netlan.55.netdev
+++ /dev/null
@@ -1,8 +0,0 @@
-[NetDev]
-Name=netlan.55
-Kind=vlan
-MACAddress=BC:24:11:D2:65:B4
-
-[VLAN]
-Id=55
-
diff --git a/resources/z9/z9-router/systemd_networkd/20-netlan.network b/resources/z9/z9-router/systemd_networkd/20-netlan.network
index 75767b56..24783430 100644
--- a/resources/z9/z9-router/systemd_networkd/20-netlan.network
+++ b/resources/z9/z9-router/systemd_networkd/20-netlan.network
@@ -5,14 +5,14 @@ Name=netlan
 RequiredForOnline=no
 
 [Network]
-#LinkLocalAddressing=no
 DHCP=no
-#IPv6AcceptRA=no
+DNS=10.89.213.1
+DNS=2a07:c481:1:36::1
 
 VLAN=netlan.51
 VLAN=netlan.52
 VLAN=netlan.53
-#VLAN=netlan.55
+#VLAN=netlan.55 # vlan 55 ist untaged im pve
 VLAN=netwan.400
 
 #Description=Management
@@ -34,4 +34,3 @@ Prefix=2a07:c481:1:36::/64
 Assign=true
 Token=static:::1
 
-
diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network b/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network
index 5e9635f6..36201b89 100644
--- a/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network
+++ b/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network
@@ -7,6 +7,8 @@ RequiredForOnline=no
 
 [Network]
 Description=clients
+DNS=10.89.208.1
+DNS=2a07:c481:1:33::1
 
 # Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network b/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network
index 5b586103..a823763b 100644
--- a/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network
+++ b/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network
@@ -7,6 +7,8 @@ RequiredForOnline=no
 
 [Network]
 Description=IoT
+DNS=10.89.212.1
+DNS=2a07:c481:1:34::1
 
 # Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network b/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network
index f544a5bc..94ee7fce 100644
--- a/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network
+++ b/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network
@@ -7,6 +7,8 @@ RequiredForOnline=no
 
 [Network]
 Description=public
+DNS=185.161.130.65
+DNS=2a07:c481:1:35::1
 
 # Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network b/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network
deleted file mode 100644
index 1e8086a1..00000000
--- a/resources/z9/z9-router/systemd_networkd/21-netlan.55-management.network
+++ /dev/null
@@ -1,27 +0,0 @@
-[Match]
-Name=netlan.55
-Type=vlan
-
-[Link]
-RequiredForOnline=no
-
-[Network]
-Description=Management
-
-# Masquerading done in nftables (nftables.conf).
-IPv6SendRA=yes
-
-[Address]
-Address=10.89.213.1/24
-
-[IPv6SendRA]
-UplinkInterface=netwan.400
-EmitDomains=true
-Domains=ccchh.net
-Managed=true
-
-[IPv6Prefix]
-Prefix=2a07:c481:1:36::/64
-Assign=true
-Token=static:::1
-