Tag Info

Hot answers tagged

20

As the dnsmasq manual says … … just use # for a wildcard:address=/#/192.168.2.1


12

You can do this by using the server= directive e.g. server=/ajax.googleapis.com/8.8.8.8 would query the google public DNS server for the ajax.googleapis.com domain, similarly server=/amazonaws.com/209.244.0.3 would query Level3's public DNS server for the amazonaws.com domain. You can group multiple domains together server=/co.uk/com/8.8.4.4 ...


7

I do the exact same thing on my dev server(s) so that I can have an rsynced mirror locally and on the off-site server with identical configs. Here's what you need in your dnsmasq.conf (make sure you restart it) assuming your webserver's internal interface is 192.168.0.3: address=/.server.mydomain.com/192.168.0.3 This will create a wildcard entry for ...


7

Refer to the DNSmasq documentation, especially the dnsmasq manpage and sample configuration file. The local keyword tells DNSmasq to perform those domain lookups with local data. This affects requests send to DNSmasq for foo.localnet and bar.localnet, for example. I don't think this is what you want. # Add local-only domains here, queries in these ...


7

Normally, you would define your static hosts in /etc/hosts and enable hosts in your dnsmasq.conf file. dnsmasq allows you to specify an alternate name for this file. If you want rtfm.lan to be addressed as 192.168.1.2 then add a line reading 192.168.1.2 rtfm.lan to /etc/hosts. Normally, your hosts file for dnsmasq should be portable to all your ...


7

Alternatively to @Chopper3 's solution, you can add iptables rules like these # Create the DHCP_clients chain in the 'raw' table iptables -t raw -N DHCP_clients # Incoming DHCP, pass to chain processing DHCP iptables -t raw -A PREROUTING -p udp --dport 67 -j DHCP_clients # Allowed DHCP clients iptables -t raw -A DHCP_clients -m mac --mac-source ...


6

Sure - this is a fairly standard thing to do to prevent clients from falling victim to one of the various malwares that change the clients' DNS settings to point to a malicious server. You can point clients to a local recursive resolver, then block outbound 53/tcp and 53/udp from all IP addresses on the network except for the local resolver.


6

DNSmasq uses the DNS TTL value for determining the caching period. You can use the dig command to query the current TTL of your DNS server for that domain.


5

ping use glibc's name resolution system, called Name Service Switch. This uses the /etc/nsswitch.conf file to know where to look for in order to resolve a name to an IP. The hosts: line in this file represents an order of preference for each service. For exemple, files represent the local /etc/hosts file, dns uses the /etc/resolv.conf file to contact a DNS ...


5

dig (domain information groper) and nslookup (query Internet name servers interactively) are tools that query name servers. Unless a specific name server is specified as a commandline argument they will query the name server(s) found in /etc/resolv.conf. They simply don't look at alternative sources of host information such as the /etc/hosts file or other ...


5

The reason you're not finding the option is that OS resolver libraries cannot use ports other than 53. While it's possible to have a nameserver forwarder use ports other than 53, it is unlikely that the authors of this software support and/or anticipate your particular use case. You would need ask them why this feature is absent. You could try something ...


5

dnsmasq has dhcp server disabled by default. To enable it you have to uncomment dhcp-related lines in /etc/dnsmasq.conf to forward all requests to 208.67.222.222 it's sufficient to add (without touching dnsmasq config) in /etc/resolv.conf: nameserver 127.0.0.1 # In order to configure dnsmasq to act as cache for the host on which it # is running, put [as ...


5

None. It's important that the nominated default gateway should be a machine on the local network which will gateway your traffic to and from the wider internet, and it's important that the nominated DNS server should be a machine which will answer your DNS queries correctly and promptly. Often these functions are consolidated into a single device, but ...


5

Setup reservations for the specific hosts using the dhcp-host option. Use tag options to flag those for a special set of options. This is completely un-tested, but I suspect your config might look something like this. Check the man page for full details. dhcp-host=00:15:99:27:f8:98,set:specialhosts,192.168.32.20 ...


5

You can do this by specifying only a static range dhcp-range=192.168.0.0,static EDIT: Change the address range above to meet your requirements. With no dynamic ranges specified dnsmask will only provide addresses to hosts that have a corresponding dhcp-host configuration # Specify a subnet which can't be used for dynamic address allocation, # is ...


5

The problem you're going to run into is that Active Directory uses DNS to tell client machines where to find various resources, so turning off DNS on the Windows server will eventually stop things that require Active Directory from working. It sounds like it worked for a number of hours because clients had it cached, but then the cache expired. My ...


5

CAN this be done? Sure - there are broken DNS servers (e.g. the ones AOL runs) that do this, and every admin I know hates it. SHOULD this be done? Almost certainly no. Generally speaking the TTL was set to a particular value for a reason (in google's case, probably fault tolerance: You'll only be unable to reach google for 5 minutes if that server blows ...


5

Answered my own question, thanks to rfc2132 dhcp-option=6,192.168.0.90,192.168.0.98 However, RFC2132 specifies option 5 as a list of name servers and option 6 as a list of domain name servers, and I'm not sure what the difference is. Either way, option 6 put them correctly as nameserver 192.168.0.90 nameserver 192.168.0.98 in /etc/resolv.conf


4

the DIRTIEST most ugliest thing that can be done is... 1-Downloading the source 2-find the file called cache.c 3-find the function is_expired 4- Change it in this way static int is_expired(time_t now, struct crec *crecp) { if (crecp->flags & F_IMMORTAL) return 0; if (difftime(now, crecp->ttd) < 0) return 0; return 0; // IT WAS ...


4

There is no "recommended alternative" to dnsmasq that I'm aware of. Dnsmasq works perfectly fine for it's purpose. You can set the TTL of local responses from a dnsmasq server with the local-ttl option. I don't know of any technical basis for the claim that "Windows is [...] more aggressive in caching DNS responses than Linux" -- as far as I know, both ...


4

I wouldn't put too much effort into having it "play nicely", I'd rather go for AD-integrated DNS instead of dnsmasq... Install DNS Server on the Windows 2003 DC Create a primary forward-lookup zone called DOMAIN.address.com Transfer the records from your Ubuntu server to the new DNS Server on the DC Convert the zone to an Active Directory-integrated zone ...


4

The 142.3.102.202 and 142.3.100.15 do not know anything about your local private network so they correctly return NXDOAIN. These are also the default name servers for the system so when you don't specify a name server they will be used. You will need to overwrite the contents of /etc/resolv.conf and configure the nameserver directives to point to your ...


3

The difference between nslookup and your browser / ping test is that nslookup will force a DNS lookup, whereas the other tests will will use the normal name resolution lookup order to resolve names. This involves looking in the DNS cache, as well as static records in the hosts file. It's possible that your computers have static records for your webserver in ...


3

DNS server adress corresponds to DHCP option 006. According to the OpenWRT Wiki your /etc/config/dhcp should look like config 'dhcp' 'lan' ... list 'dhcp_option' '6,yourDNSIP'


3

If you have dnsmasq enabled you need to use DHCP-option 6 So in /etc/dnsmasq.conf you would add: dhcp-option=6,8.8.8.8,8.8.4.4 To add the google DNS servers


3

It's very simple - nslookup is specifically a DNS tool - it's part of the BIND tools. It simply doesn't know about the other name services that library calls such as gethostbyname can access via NSS because nslookup doesn't use gethostbyname, etc.


3

Do you have a .dev zone in DNS already? You can create a wildcard entry where *.dev goes to the loopback.


3

@Khaled I have an authoritative nameserver on this computer and would like to forbid access to some websites via /etc/hosts. With bind you can use a Response policy zone to get a similar effect. It isn't an /etc/hosts file, but you can get the similar results. ie blocking specific domains. options { ... response-policy { zone "rpz"; }; }; ... ...


3

The address option will accept fully qualified domain names. address=/mydomain.com/192.168.1.156


3

Your machine is configured to respond to IPv4 pings and not to respond to IPv6 pings. When IPv6 is enabled, other machines gets the IPv6 address when they try to resolve the name because IPv6 is preferred. As a result, they issue a ping that does not get a reply. ping -4 won't work because you can't do an IPv4 ping to an IPv6 address. If you want the ...



Only top voted, non community-wiki answers of a minimum length are eligible