For the moment I've set the DNS forwarder on my NAS to my Synology Router (DNS package installed), and that forwards than back to the AdGuard container. Not pretty, but it works for now...
I'm using this on my NAS...
With that arrangement, NAS DNS requests are passed through my router. That all said, I have DNS traffic (some, not a lot) going through the MacLAN IP.
An aside... with a few days of traffic, I have 100,000 DNS requests, 28,000 of which are blocked. Of those. Roku accounts for 10,000 blocked requests.
I was also surprised at how chatty my Samsung TV is... so, I've blocked nearly all samsung traffic...
I'm still trying to determine how to block domains by device. For example, my TV occasionally calls out for yahoo.com. I'd like to block that without blocking Yahoo entirely. If you get something working along those lines, please share.