|
Size: 2919
Comment:
|
Size: 3212
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 3: | Line 3: |
| '''`dnsmasq(8)`''' is a lightweight DNS server. It also offers DHCP, proxy DHCP, TFTP, PXE... none of which will be described here. | '''`dnsmasq(8)`''' is a lightweight DNS server. It also offers DHCP, proxy DHCP, TFTP, and PXE. |
| Line 13: | Line 13: |
| Install the `dnsmasq` package through your preferred package manager. | Most [[Linux]] and [[BSD]] distributions offer a `dnsmasq` package. |
| Line 16: | Line 16: |
For BSD distributions, try: {{{ service dnsmasq restart }}} To launch the server on startup, update /etc/rc.conf: {{{ dnsmasq_enable="YES" dnsmasq_conf="/usr/local/etc/dnsmasq.conf" }}} |
|
| Line 23: | Line 36: |
| `dnsmasq(8)` is configured in `/etc/dnsmasq.conf`. You can test the configuration using `dnsmasq --test`. | `dnsmasq(8)` is configured with a configuration file. This typically is located in either `/etc/dnsmasq.conf` (for Linux distributions) or `/usr/local/etc/dnsmasq.conf` (for BSD distributions). Test the configuration using `dnsmasq --test`. |
| Line 40: | Line 55: |
| To disable the DNS features of `dnsmasq(8)`, edit `/etc/dnsmasq.conf` such that... | To disable the DNS features of `dnsmasq(8)`, edit the configuration file such that... |
| Line 52: | Line 67: |
| 1. Configure `openresolv` as described in [[Linux/resolvconf.conf#Example|this example]], and include the below lines in `/etc/dnsmasq.conf`: | 1. Configure `openresolv` as described in [[Linux/resolvconf.conf#Example|this example]], and include the below lines in the configuration file: |
| Line 60: | Line 75: |
| 2.#2 Manually configure `/etc/resolv.conf` like... | 2.#2 Manually configure like... |
| Line 68: | Line 83: |
| ...and manually configure `/etc/dnsmasq.conf` like... | ...and manually configure like... |
| Line 119: | Line 134: |
| Line 121: | Line 138: |
| `dnsmasq.service` will fail if one of the listening IPs isn't bindable, as would be the case with a [[Encryption/WireGuard|WireGuard]] interface. | The service will fail if one of the listening IPs isn't bindable, as would be the case with a [[Encryption/WireGuard|WireGuard]] interface that has not opened yet. |
| Line 129: | Line 146: |
| Note that some distributions vendor the configurations to set `bind-interface`. For example, ubuntu ships `/etc/dnsmasq.d/ubuntu-fan`. | Note that some distributions vendor the configurations to set `bind-interface`. For example, [[Linux/Ubuntu|Ubuntu]] ships `/etc/dnsmasq.d/ubuntu-fan`. |
| Line 131: | Line 148: |
| Another solution is to force `systemd` to start `[email protected]` first. With `systemctl edit dnsmasq`... | Another solution is to ensure that the interface opens first. With `systemctl edit dnsmasq`... |
dnsmasq
dnsmasq(8) is a lightweight DNS server. It also offers DHCP, proxy DHCP, TFTP, and PXE.
Contents
Installation
Most Linux and BSD distributions offer a dnsmasq package.
For systemd-capable systems, start and enable dnsmasq.service.
For BSD distributions, try:
service dnsmasq restart
To launch the server on startup, update /etc/rc.conf:
dnsmasq_enable="YES" dnsmasq_conf="/usr/local/etc/dnsmasq.conf"
Configuration
dnsmasq(8) is configured with a configuration file. This typically is located in either /etc/dnsmasq.conf (for Linux distributions) or /usr/local/etc/dnsmasq.conf (for BSD distributions).
Test the configuration using dnsmasq --test.
A basic configuration file is:
listen-address=::1,127.0.0.1 cache-size=150 # DNSSEC conf-file=/usr/share/dnsmasq/trust-anchors.conf dnssec
Disable DNS
To disable the DNS features of dnsmasq(8), edit the configuration file such that...
port=0
Recursive DNS
dnsmasq(8) is not a recursive DNS server, so trusted (i.e. DNSSEC) forwarding must be setup. Pursue one of the following configurations:
Configure openresolv as described in this example, and include the below lines in the configuration file:
# Configurations generated by `resolvconf(1)` conf-file=/etc/dnsmasq-conf.conf resolv-file=/etc/dnsmasq-resolv.conf
- Manually configure like...
127.0.0.1 localhost ::1 localhost trust-ad
- ..and manually configure like...
no-hosts no-resolv server=8.8.8.8 server=8.8.4.4
Network DNS
To operate dnsmasq(8) as a DNS server, ensure that it listens on a private address.
listen-address=::1,127.0.0.1,192.168.86.1
Overriding Names
dnsmasq(8) offers a search/replace syntax for forcing names to resolve into hardcoded addresses. Specificity wins, so given...
address=/example.com/1.2.3.4 address=/www.example.com/2.3.4.5
...www.example.com would resolve to 2.3.4.5.
Blacklisting Names
To blacklist a name, use the search/replace syntax and return a blank address.
address=/example.com/
Managed blacklists can be inserted, as with conf-file=/etc/dnsmasq.d/blocklist.conf or conf-dir=/etc/dnsmasq.d/,*.conf.
Troubleshooting
WireGuard Interfaces
The service will fail if one of the listening IPs isn't bindable, as would be the case with a WireGuard interface that has not opened yet.
One solution is to switch to dynamic binding. In /etc/dnsmasq.conf...
bind-dynamic
Note that some distributions vendor the configurations to set bind-interface. For example, Ubuntu ships /etc/dnsmasq.d/ubuntu-fan.
Another solution is to ensure that the interface opens first. With systemctl edit dnsmasq...
[Unit] [email protected] [email protected]