3

I would like to ask a question about configuring of dnsmasq DNS server. I know about such configuration option as "listen-address". But even if I set this option to "listen-address=127.0.0.1" dnsmasq still open port on both internal 127.0.0.1:53 and external 192.168.x.x:53 sides.

So I would like to ask if it is possible to configure dnsmasq so that it opens port 53 just for localhost (127.0.0.1) like for example it is possible for MySQL database.

# Configuration file for dnsmasq.

port=53
proxy-dnssec
no-resolv
no-poll
server=127.0.0.1#[some port here]
server=127.0.0.1#[some another port here]
listen-address=127.0.0.1
no-hosts
  • Sure you can. Please post your configuration file and the transcript. Of course, don't forget a sanity check: stop dnsmasq and verify if nothing else listens on 53 on external interface. – techraf Aug 26 '16 at 1:00
  • @techraf # Configuration file for dnsmasq. port=53 proxy-dnssec no-resolv no-poll server=127.0.0.1#[some port here] server=127.0.0.1#[some another port here] listen-address=127.0.0.1 no-hosts Also when I stop dnsmasq service so port 53 is closed on 127.0.0.1 and 192.168.x.x sides. – D.K. Aug 27 '16 at 1:48
9

I had to add "bind-interfaces" to the config file, so that interface and listen-address had the desired effect. E.g.:

listen-address=127.0.0.1
interface=lo
bind-interfaces

This will have the desired effect of listening only on localhost. I was running into issues, since I was running a public dns (that resolves just my own domains) on the public ip of the server, but I wanted to run dnsmasq on localhost, too. So if I remove "bind-interfaces", I will get "dnsmasq: failed to create listening socket for port 53: Address already in use", as it tries to listen on the public IP.

| improve this answer | |
3

Yes you can do that

The dnsmasq man page says this about the --interface argument:

 -i, --interface=<interface name>
          Listen only on the specified interface(s). Dnsmasq automatically adds the loopback (local) interface to the list of interfaces  to  use
          when  the  --interface option  is used. If no --interface or --listen-address options are given dnsmasq listens on all available inter‐
          faces except any given in --except-interface options. IP alias interfaces (eg "eth1:0") cannot be used with  --interface  or  --except-
          interface  options,  use  --listen-address  instead.  A  simple  wildcard, consisting of a trailing '*', can be used in --interface and
          --except-interface options.

The interface name for localhost/127.0.0.1 would be lo by default on most systems.

You can put it right in your config file like so

interface=lo

Or specify it on the command line like so

dnsmasq --interface=lo
| improve this answer | |
  • 1
    I tried your advice, Ryan, but unfortunatelly such way it still opens port on external side. Also when interface is set like "interface=lo" dnsmasq always response to request like "dig @192.168.x.x" even if "listen-address=127.0.0.1" But when "interface" option is commented out dnsmasq follows "listen-address" option and response just to "dig @127.0.0.1" if "listen-address=127.0.0.1" – D.K. Aug 27 '16 at 1:29
  • @LargoWinch That doesn't make sense. And, in your question you said listen-address didn't work, and that was why you were asking for help. What's going on? – Ryan Babchishin Aug 27 '16 at 1:48
  • There are 2 thing here. 1) Dnsmasq always opens ports on 127.0.0.1 and 192.168.x.x (I check this with nmap) 2) another thing is dnsmasq respons on just "@127.0.0.1" when "listen-address=127.0.0.1". When I set "interface=lo" dnsmasq starts to ignore "listen-address=127.0.0.1" and answers requests for "@192.168.x.x". But my question was if it is possible to do so that dnsmasq not open port on 192.168.x.x side at all. For now I managed to do just so that dnsmasq opens port on both sides but ignores requests "@192.168.x.x". – D.K. Aug 27 '16 at 1:57
  • @LargoWinch try to pass --interface=lo on the command line to dnsmasq instead. – Ryan Babchishin Aug 27 '16 at 3:12
  • This is how I tried, Ryan: dnsmasq is run as service, so line for starting looks like this one. (ExecStart=/usr/bin/dnsmasq -k --enable-dbus --user=dnsmasq --pid-file --interface=lo). So I tested and results was the same as with changes in configuration. Dnsmasq just ignores "listen-address" in this case and ports being still opened both sides. – D.K. Aug 27 '16 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.