I got this from TP-Link long time ago: we have already considered the security issue, and have already blocked the related SSH tunnels and commands, which makes this SSH available only to the Tether APP.  Other SSH clients cannot control the router via commands.

I have a similar issue 
My C7 does not allow me to change DNS   to my local pihole machine

DNS server IP address and LAN IP address cannot be in the same subnet.

I was trying to login via SSH but my user and password is not working.
 

TP-link should put such information on a box so customers before buying will be aware that will not be able to connect own equipment and change setting like they need  as SSH access is not allowed.
 

I don't want to replace firmware  for DDWRT/OpenWrt but  with your polices it look like I don't have any other choice 

@PawelM Are you changing the DNS address in the right place? Ensure you are setting your Pihole's addres under DHCP server, and not under Internet. I've been using a pihole and a C7 router for ages and it's worked flawlessley. Hopefully they haven't changed this feature on the C9!