Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At my work desktop running openSUSE 11.4, I have a local network which gets its address, domain (work.site) and nameservers (10.100.1.1, 10.100.1.2) info through DHCP - which get written into /etc/resolv.conf

I get to access the internet using the work network, and these 2 nameservers end up returning the entries for any public domain name lookups on the internet.

I also have a private VPN that I end up connecting. The nameserver (10.111.1.1) and domain (private.site) are rarely bound to change for this network, but currently they're pushed by the openVPN client into networkmanager, and which also gets merged with the existing /etc/resolv.conf

My resolv.conf ultimately ends up looking like this:

search private.site work.site
nameserver 127.0.0.1
nameserver 10.111.1.1
nameserver 10.100.1.1

As you can see the 2nd nameserver from my work network was pushed out because of the max 3 entry limitations. It is fine still, but would be a problem if that nameserver goes down for maintenance or something.

So I found out that dnsmasq could help me here, and hence I setup dnsmasq just as a local DNS resolver without any DHCP support.

So right now this is my /etc/dnsmasq.conf:

resolv-file=/etc/resolv.conf
server=/private.site/10.111.1.1
server=/1.111.10.in-addr.arpa/10.111.1.1
listen-address=127.0.0.1
bind-interfaces
log-queries

I've made dnsmasq get the list of nameservers from /etc/resolv.conf since NetworkManager seems to be updating this list correctly (for a max of 3 nameservers). I'm able to resolve the host names in both the networks correctly.

So these are the questions I have:

  1. Is there a way I can make either NetworkManager or dhclient write out the list of nameservers somewhere else which I can make dnsmasq use as resolv-file ?
  2. How do I make dnsmasq use certain nameservers as the default for all queries ? Right now I notice that lookups for public domains on the internet are usually sent to both the nameservers - the one on work.site as well as private.site. It would be good if I can limit this only to work.site.

UPDATE: These are the solutions I've found: In /etc/sysconfig/network/config change the following:

NETCONFIG_DNS_FORWARDER="dnsmasq"
NETCONFIG_DNS_FORWARDER_FALLBACK="no"
NETCONFIG_DNS_STATIC_SEARCHLIST="work.site private.site"

In /etc/dnsmasq.conf add these lines:

resolv-file=/var/run/dnsmasq-forwarders.conf

I also had to modify my openVPN server.conf not to push nameservers for the clients, since I had already added a server rule in my dnsmasq.conf for that domain.

share|improve this question
    
BTW, NetworkManager in Ubuntu 12.04 does all of this automatically when connecting to a VPN using NM (i.e. running a dnsmasq so that queries get sent to the right server). –  mgorven May 31 '12 at 4:10

1 Answer 1

up vote 1 down vote accepted

If you install resolvconf, NetworkManager will use it instead of writing /etc/resolv.conf directly. The DNS servers from NM can then be found in /var/run/resolvconf/interface/NetworkManager.

dnsmasq is sending all queries to 10.111.1.1 because it's listed in resolv.conf -- you probably want to remove it from resolv.conf so that it only gets used for the private.site domain. The nameservers in resolv.conf are essentially the defaults.

share|improve this answer
    
Thanks for the info about how dnsmasq treats the resolv-file - that helped a lot. After digging a lot, I came to know openSUSE's netconfig tool is kind of similar to resolvconf or openresolv does underneath - helps merge nameserver entries into a file. The behaviour is controlled by NETCONFIG_DNS_FORWARDER= which I have set to dnsmasq. It writes the nameservers into /var/run/dnsmasq-forwarders.conf which I've set as resolv-file in dnsmasq.conf. I've now also set NETCONFIG_DNS_FORWARDER_FALLBACK="no" to make sure no nameserver entries are written into /etc/resolv.conf. –  Tuxdude May 31 '12 at 23:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.