FoxuTech

How to Configure DNSMasq on Ubuntu

How to Configure DNSMasq

Dnsmasq is a lightweight, easy to configure, DNS forwarder and DHCP server. It is designed to provide DNS and optionally, DHCP, to a small network. It can serve the names of local machines which are not in the global DNS. The DHCP server integrates with the DNS server and allows machines with DHCP-allocated addresses to appear in the DNS with names configured either in each host or in a central configuration file. Dnsmasq supports static and dynamic DHCP leases and BOOTP/TFTP for network booting of diskless machines

Basic DNS Setup & Test

First let’s install the package,

#apt-get update

#apt-get install dnsmasq

Once you setup simple DNS server, you can test it using DNS lookup tool pointed at localhost.

# dig foxutech.com @localhost

or

# nslookup foxutech.com localhost

By default, DNS is configured to forward all requests to your system’s default DNS settings. In case you didn’t know, these are stored in the /etc/resolv.conf file. Now, if you want to add some names for your DNS server to resolve for your clients, simply add them to your /etc/hosts file.

Interfaces

DNSmasq should know which interface it should listen. We have to mention on dnsmasq.conf file. If you don’t want to listening on internet, in /etc/dnsmasq.conf comment 69th line, like below

#interface=

You can uncomment the line and specify which ethernet interface(s) you want it server IPs to. For example, if I want it to listen on eth1 (DMZ) and eth2 (local network), then it should look like:

interface=eth1

interface=eth2

If we didn’t edit this line, it would also listen on eth0, my internet connection. we personally wouldn’t recommend this, for some security reason.

DHCP Setup

By default, DHCP is turned off. This is a good thing, as you could bring down whatever network you are connected to if you are not careful.

To enable it, there is at least one line will need to edit in the /etc/dnsmasq.conf file. Around line 143, you will see:

#dhcp-range=192.168.0.4,192.168.0.100,12h

To enable the DHCP server, you will need to give it a range of IP addresses to hand out. In the example above, this server would hand out 96 address starting at 192.168.0.4 and ending at 192.168.0.100. The last number is how long the DHCP leases are good for. In this example, they would be good for twelve hours.

Since I have two different networks that need DHCP, I’m going to change that line to:

dhcp-range=eth1,192.168.0.100,192.168.0.199,4h

dhcp-range=eth2,192.168.1.100,192.168.1.199,4h

Notice the “eth1” and “eth2” labels in the lines above? The aren’t necessary, but definitely help once you start playing with more advanced configurations. It also helps me remember which range is which. Now restart your dnsmasq server, connect up a few clients, and see if they autoconfigure themselves:

#/etc/init.d/dnsmasq restart

Local Caching

Using dnsmasq to cache DNS queries for the local machine is a bit tricky (unless you’re using NetworkManager, see below), since all DNS queries from the local machine need to go to dnsmasq, while as the same time, dnsmasq must be configured to forward all those queries to upstream DNS servers.

The dnsmasq man page suggests the following:

There is, however, a simpler method; simply ensure that the machine’s list of nameservers contains the line

nameserver 127.0.0.1

as the first line, followed by the upstream nameservers. dnsmasq is smart enough to ignore this line and forward all queries appropriately, while all other applications will send all their queries to dnsmasq.

Exaclty how to do this depends on the method(s) of network configuration in use. If you’re manually hardcoding the nameservers (either in /etc/resolv.conf or elsewhere, such as a stanza in /etc/network/interfaces or in the Wicd GUI), then just add a reference to 127.0.0.1 as the first entry in the list. If you’re using DHCP, then instruct your client to prepend 127.0.0.1 to the DHCP servers it receives. E.g., with dhclient, include the line

prepend domain-name-servers 127.0.0.1;

in the dhclient configuration file (/etc/dhcp3/dhclient.conf). [On my Sid system, the default configuration file shipped with the package contains that line, but commented out.]

Note that if you plan to use dnsmasq for the local system only, you should lock it down by adding the line

listen-address=127.0.0.1

to the dnsmasq configuration file (/etc/dnsmasq.conf).

Local Caching using NetworkManager

Set this in /etc/NetworkManager/NetworkManager.conf:

[main]

dns=dnsmasq

and restart network-manager service.

dnsmasq with dnscrypt-proxy

dnsmasq combined with dnscrypt-proxy provide caching, encryption and server-side authentication. Useful to protect a laptop from potentially hostile networks.

# apt-get install dnsmasq dnscrypt-proxy

## Configure /etc/resolv.conf to use dnsmasq

nameserver 127.0.0.1

## Configure /etc/dnsmasq.conf

# ignore resolv.conf

no-resolv

# Listen only on localhost

listen-address=127.0.0.1

# dnscrypt is on port 40

server=127.0.0.1#40

## Configure /etc/systemd/system/sockets.target.wants/dnscrypt-proxy.socket with the following 5 lines if you are using systemd

[Socket]

ListenStream=

ListenDatagram=

ListenStream=127.0.0.1:40

ListenDatagram=127.0.0.1:40

## restart both daemons

Exit mobile version