dnsmasq

dnsmasq 提供 DNS 服務器、支持 DHCPv6 和 PXE 的 DHCP 服務器、TFTP 服務器。它設計為輕量且占用空間小，適用於資源受限的路由器和防火牆。還可以將 dnsmasq 配置為 DNS 緩存查詢，以提高對以前訪問過站點的 DNS 查找速度。

啟動守護程序[編輯 | 編輯原始碼]

啟動/啟用 dnsmasq.service。

要查看 dnsmasq 是否正確啟動，可以檢查系統的 journal：

# journalctl -u dnsmasq.service

還需要重新啟動網絡，以便 DHCP 客戶端可以創建新的 /etc/resolv.conf。

In case there is already a DHCP server running on the network and you want to interoperate with it, dnsmasq can be set to behave as a "proxy DHCP", therefore only serving the #PXE server specific information to the client. This mode is only available with IPv4. Use the following syntax, providing the existing DHCP server address:

dhcp-range=192.168.0.1,proxy

Test[編輯 | 編輯原始碼]

From a computer that is connected to the one with dnsmasq on it, configure it to use DHCP for automatic IP address assignment, then attempt to log into the network normally.

If you inspect the /var/lib/misc/dnsmasq.leases file on the server, you should be able to see the lease.

TFTP server[編輯 | 編輯原始碼]

dnsmasq has built-in TFTP server.

To use it, create a root directory for TFTP (e.g. /srv/tftp) to put transferable files in.

enable-tftp
tftp-root=/srv/tftp

For increased security it is advised to use dnsmasq's TFTP secure mode. In secure mode only files owned by the dnsmasq user will be served over TFTP. You will need to chown TFTP root and all files in it to dnsmasq user to use this feature.

tftp-secure

See dnsmasq(8) for more options.

PXE server[編輯 | 編輯原始碼]

PXE requires a DHCP and a TFTP server; both can be provided by dnsmasq. To setup the PXE server, follow these steps:

Setup the #TFTP server and the #DHCP server (in full DHCP or proxy mode) in the dnsmasq configuration file,
Copy and configure a PXE compatible bootloader (e.g. PXELINUX) in the TFTP root directory,
Enable PXE in the dnsmasq configuration file:

To simply send one file:

dhcp-boot=lpxelinux.0

To send a file depending on client architecture:

pxe-service=x86PC,"PXELINUX (BIOS)",bios/lpxelinux
pxe-service=X86-64_EFI,"PXELINUX (EFI)",efi64/syslinux.efi

注意：

File paths are relative to the TFTP root path
If the file has a .0 suffix, you must exclude the suffix in pxe-service options

In case pxe-service does not work to identify the architecture (especially for UEFI-based clients), combination of dhcp-match and dhcp-boot can be used. See RFC 4578 2.1 for more client-arch numbers for use with dhcp boot protocol.

dhcp-match=set:efi-x86_64,option:client-arch,7
dhcp-match=set:efi-x86_64,option:client-arch,9
dhcp-match=set:efi-x86,option:client-arch,6
dhcp-match=set:bios,option:client-arch,0
dhcp-boot=tag:efi-x86_64,efi64/syslinux.efi
dhcp-boot=tag:efi-x86,efi32/syslinux.efi
dhcp-boot=tag:bios,bios/lpxelinux.0

See dnsmasq(8) for more options.

The rest is up to the bootloader.

Tips and tricks[編輯 | 編輯原始碼]

Prevent OpenDNS redirecting Google queries[編輯 | 編輯原始碼]

To prevent OpenDNS from redirecting all Google queries to their own search server, add to /etc/dnsmasq.conf:

server=/www.google.com/<ISP DNS IP>

Override addresses[編輯 | 編輯原始碼]

In some cases, such as when operating a captive portal, it can be useful to resolve specific domains names to a hard-coded set of addresses. This is done with the address config:

address=/example.com/1.2.3.4

Furthermore, it is possible to return a specific address for all domain names that are not answered from /etc/hosts or DHCP by using a special wildcard:

address=/#/1.2.3.4

More than one instance[編輯 | 編輯原始碼]

If we want two or more dnsmasq servers works per interface(s).

Static[編輯 | 編輯原始碼]

To do this staticly, server per interface, use interface and bind-interfaces options. This enforce start second dnsmasq.

Dynamic[編輯 | 編輯原始碼]

In this case we can exclude per interface and bind any others:

except-interface=lo
bind-dynamic

注意： This is the default in libvirt.

Domain blocklisting[編輯 | 編輯原始碼]

To blocklist domains, i.e. answer queries for them with NXDOMAIN, use the address option without specifying the IP address:

address=/blocked.example/
address=/anotherblocked.example/

注意： Unlike the /etc/hosts file, dnsmasq will block these domains and also all subdomains such as subdomain.blocked.example.

Wildcards are also supported. Add a * to the start of the pattern:

# blocks both blocked.example and anotherblocked.example and all their subdomains
address=/*blocked.example/

# blocks subdomains like mail.google.com but not google.com
address=/*.google.com/

Some specific subdomains can be unblocked using # as the server address:

# blocks google.com and all subdomains except mail.google.com.
address=/google.com/
server=/mail.google.com/#

注意：

The options address=/example.com/ and server=/example.com/ are equivalent. Both will answer queries for them with NXDOMAIN.
The options address=/example.com/# and server=/example.com/# are not equivalent.
- address=/example.com/# will answer queries for the domain with the NULL address (0.0.0.0 or :: for IPv6).
- server=/example.com/# will send queries for the domain to the standard configured servers.
The patterns /example.com/ and /.example.com/ are equivalent. Both will match example.com and all its subdomains.

For ease of use place the blocklist in a separate file, e.g. /etc/dnsmasq.d/blocklist.conf and load it from /etc/dnsmasq.conf with conf-file=/etc/dnsmasq.d/blocklist.conf or conf-dir=/etc/dnsmasq.d/,*.conf.

提示：

A list of potential sources for the blocklist can be found in OpenWrt's adblock package's README.
A hosts file blocklist can be used with the addn-hosts=hosts.txt option or it can be converted to a dnsmasq blocklist with this awk command: awk '/^[^#]/ { print "address=/"$2"/"$1"" }' hosts.txt.

參閱[編輯 | 編輯原始碼]

Caching Nameserver using dnsmasq, and a few other tips and tricks.

dnsmasq

安裝[編輯 | 編輯原始碼]

啟動守護程序[編輯 | 編輯原始碼]

配置[編輯 | 編輯原始碼]

DNS 服務器[編輯 | 編輯原始碼]

DNS 地址文件和轉發[編輯 | 編輯原始碼]

openresolv[編輯 | 編輯原始碼]

手動轉發[編輯 | 編輯原始碼]

添加自定域[編輯 | 編輯原始碼]

測試[編輯 | 編輯原始碼]

DHCP 服務器[編輯 | 編輯原始碼]

Proxy DHCP[編輯 | 編輯原始碼]