dnsmasq server
Small DNS/DHCP server for home/office network.
2022-09-12 Ubuntu 22.04
Assumes network as follows:
- Network
- 192.168.99.0/24
- Gateway/WAN router
- 192.168.99.1
- dnsmasq server
- 192.168.99.20
- Domain name
home.arpa(per RFC 8375)- DHCP server upstream DNS servers
- 1.1.1.1, 1.0.0.1 (cloudflare) in
/etc/resolv.dnsmasq - DHCP client DNS servers
- 192.168.99.20, 1.1.1.1
- Permanent IP addresses
- 192.168.99.1 to 192.168.99.99
- Dynamic IP addresses
- 192.168.99.100 to 192.168.99.199 (1d lease)
- Map MAC address↔hostname
/etc/ethers- Map hostname↔IP address
/etc/hosts.dnsmasq
Firstly dispense with systemd-resolved as dnsmasq replaces it and they collide on use of port 53.
graham:~ sudo systemctl stop systemd-resolved graham:~ sudo systemctl disable systemd-resolved graham:~ sudo unlink /etc/resolv.conf # use temporary name server graham:~ echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.confInstallation
graham:~ sudo apt update graham:~ sudo apt install dnsmasq
We effectively split up the provided /etc/dnsmasq.conf
into subsystems and configure them separately.
It contains no settings, only comments and defaults, so there is no
harm in leaving it in situ. The comments however are very useful and
it is recommended to use the full files referenced below rather than just
the settings as shown.
DNS server
graham:~ sudo vi /etc/dnsmasq.d/dns.conf/etc/dnsmasq/dns.conf
new file
Note that the following only shows the settings changed from
default – see dns.conf in full
#port 53 domain-needed bogus-priv resolv-file=/etc/resolv.dnsmasq local=/home.arpa/ no-hosts addn-hosts=/etc/hosts.dnsmasq log-queries
/etc/dnsmasq.d/blacklist.conf new file
# blacklist.conf - block domains from DNS queries # # redirect them into blackhole address=/double-click.net/0.0.0.0 address=/facebook.com/0.0.0.0 address=/facebook.net/0.0.0.0 address=/imrworldwide.com/0.0.0.0
/etc/resolv.dnsmasq new file
# resolv.dnsmasq - upstream name servers # cloudflare nameserver 1.1.1.1 nameserver 1.0.0.1
/etc/resolv.conf replace contents
# resolv.conf - loopback to local dnsmasq nameserver 127.0.0.1
/etc/hosts new file
Obviously, populate with your own IP addresses and hostnames.
# hosts.dnsmasq - map IP address to hostname 192.168.99.1 gateway # WAN router/gateway 192.168.99.20 messmate # Mac Mini 192.168.99.23 paperbark # RPi 4 192.168.99.25 ironbark # RPi 4 192.168.99.27 stringybark # RPi 4 + RAK2245 192.168.99.39 huonpine # MacBook Pro
/etc/hosts IP addresses not offered by dnsmasq
127.0.0.1 localhost 255.255.255.255 broadcasthost ::1 ip6-localhost fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters # not assigned by dnsmasq 127.0.1.1 messmate.home.arpa
DHCP server
graham:~ sudo vi /etc/dnsmasq.d/dhcp.conf/etc/dnsmasq/dhcp.conf
new file
Note that the following only shows the settings changed from default
– see dhcp.conf in full
expand-hosts domain=home.arpa dhcp-range=set:POOL,192.168.99.100,192.168.99.199,1d read-ethers dhcp-option=option:router,192.168.99.1 dhcp-option=option:dns-server,192.168.99.20,1.1.1.1 dhcp-option=option:domain-name,home.arpa dhcp-option=option:domain-search,home.arpa dhcp-authoritative dhcp-rapid-commit log-dhcp synth-domain=home.arpa,192.168.99.100,192.168.99.199,pool-*
- Our DHCP server will barge in and override other servers on this LAN segment (there shouldn't be any!).
-
Names handed out from the pool for non-preidentifed (by mac address)
hosts are of form
pool-nnn.home.arpa(nnn between 0 and 99) – try digging for some.
/etc/ethers new file
Obviously, populate with your own MAC addresses and hostnames.
# ethers - map MAC address to hostname # # hostname must be DNS-resolvable ac:87:a3:25:7b:00 messmate d8:47:32:d6:97:d0 gateway dc:a6:32:b0:b5:a4 paperbark dc:a6:32:e0:aa:12 ironbark dc:a6:32:ea:65:c8 stringybark f4:d4:88:88:cb:d6 huonpine
TFTP server
graham:~ sudo vi /etc/dnsmasq.d/tftp.conf-OFF/etc/dnsmasq/tftp.conf-OFF
new file (empty)
Note that this file has no settings changed from the default –
see tftp.conf in full
to capture the useful comments.
Common to all subsystems
graham:~ sudo vi /etc/dnsmasq.d/common.conf-OFF/etc/dnsmasq/common.conf-OFF
new file (empty)
Note that this file has no settings changed from the default – see
common.conf in full
to capture the useful comments.
- Correct any reported syntax errors in dnsmasq config.
/etc/netplan/00-installer-config.yaml
update interface definition
network:
version: 2
renderer: networkd
ethernets:
enp3s0f0:
dhcp4: false
addresses: [ 192.168.99.20/24 ]
routes:
- to: default
via: 192.168.99.1
on-link: true
nameservers:
addresses: [ 127.0.0.1 ]
/etc/rsyslog.d/dnsmasq.conf new file
# dnsmasq.conf - syslog config :programname,startswith,"dnsmasq" /var/log/dnsmasq.log :programname,startswith,"dnsmasq" stop
/etc/logrotate.d/dnsmasq new file
# dnsmasq - logrotate config
/var/log/dnsmasq.log
{
daily
missingok
rotate 7
compress
delaycompress
notifempty
sharedscripts
postrotate
pkill -USR2 dnsmasq
/usr/lib/rsyslog/rsyslog-rotate
endscript
}
- Disable existing DHCP server (probably in WAN router/gateway) before starting dnsmasq to prevent conflicting requests.
- Verify dnsmasq seems to have started okay.
Appendix: NoTracking – domain blacklist
NoTracking is a publicly maintained blacklist of advertising and malware domains. With the perfomance penalty of checking more than ¼million entries on each uncached domain lookup, these domains can be blocked at the DNS level.
graham:~ sudo vi /usr/local/sbin/update-notracking/usr/local/sbin/update-tracking new file
#!/bin/sh
# install NoTracking blocklist in dnsmasq.
# dnsmasq must be restarted (HUP insufficient) to utilise - not done here.
#
# see https://github.com/notracking/hosts-blocklists
# config
bl_url="https://raw.githubusercontent.com/notracking/hosts-blocklists/master"
bl_url="${bl_url}/dnsmasq/dnsmasq.blacklist.txt"
bl_line='^address=\/[-._a-zA-Z0-9]*\/\#$'
target="/etc/dnsmasq.d/notracking.conf"
abort () {
[ $# -gt 0 ] && echo "$@" 1>&2
exit 1
}
# parse command line
[ $# -gt 0 ] && abort "usage: $0"
# fetch & check blacklist file
umask 022
bl_file=$(mktemp)
trap 'rm -f "$bl_file"' 0
curl --silent --show-error --fail "$bl_url" --output "$bl_file" || abort
grep -v -e '^#' -e "$bl_line" "$bl_file" &&
abort "rejected: some malformed entries"
# install blacklist file
chmod 644 "$bl_file"
mv "$bl_file" "$target"
…temp file… append to end
# dnsmasq maintenance # # update blocklists 11 1 * * 6 /usr/local/sbin/update-notracking && systemctl restart dnsmasq