Allowing queries only from the local subnet is enough for the functionality of PiVPN.
Allowing queries only from the local subnet is enough for the functionality of PiVPN.

  From the man page of dnsmasq:
  --local-service
    Accept DNS queries only from hosts whose address is on a local subnet,
    ie a subnet for which an interface exists on the server. This option only
    has effect if there are no --interface, --except-interface, --listen-address
    or --auth-server options. It is intended to be set as a default on installation,
    to allow unconfigured installations to be useful but also safe from being
    used for DNS amplification attacks.

pivpn/pivpn