I have configured dnsmasq and openresolv as described in
https://unix.stackexchange.com/a/575449/2421 so that the DNS servers
provided by the VPN are only used for the domains on that network.
With dnsmasq 2.86 and openresolv 3.12.0 this was working great, but I
was setting up a new computer the same way and discovered that DNS
lookups broke when I disconnected from the VPN (causing resolvconf to
remove the private DNS servers). I soon realized that the new machine
had gotten dnsmasq 2.87, which I hadn't yet upgraded to on the old
machine (it had dnsmasq 2.86).
The symptom is that all DNS requests (except those for other machines on
my LAN) are refused by dnsmasq:
$ nslookup www.google.com
Server: ::1
Address: ::1#53
** server can't find www.google.com: REFUSED
Restarting dnsmasq fixes the problem until the next time I disconnect
the VPN.
I installed dnsmasq 2.86 on the new machine and the problem went away.
If I put 2.87 back, the problem also comes back. It seems that
something in 2.87 breaks with my setup. BTW, openresolv 3.12.0 uses
DBus to add/remove nameservers instead of editing the dnsmasq config files.
I turned on debug logging. When I connect the VPN, I see this in the log:
Oct 9 16:40:15 dnsmasq[105349]: setting upstream servers from DBus
Oct 9 16:40:15 dnsmasq[105349]: using nameserver 192.168.1.1#53
Oct 9 16:40:15 dnsmasq[105349]: using nameserver fd...::1#53
Oct 9 16:40:15 dnsmasq[105349]: using nameserver 10.3.10.24#53 for
domain example.com
Oct 9 16:40:15 dnsmasq[105349]: using nameserver 10.3.10.26#53 for
domain example.com
Oct 9 16:40:15 dnsmasq[105349]: using nameserver 10.3.10.25#53 for
domain example.com
Oct 9 16:40:15 dnsmasq[105349]: using nameserver 10.3.10.24#53 for
domain example.org
Oct 9 16:40:15 dnsmasq[105349]: using nameserver 10.3.10.26#53 for
domain example.org
Oct 9 16:40:15 dnsmasq[105349]: using nameserver 10.3.10.25#53 for
domain example.org
Oct 9 16:40:15 dnsmasq[105349]: using nameserver 192.168.1.1#53 for
domain lan.example.net
Oct 9 16:40:15 dnsmasq[105349]: using nameserver fd...::1#53 for domain
lan.example.net
Oct 9 16:40:15 dnsmasq[105349]: read /etc/hosts - 0 addresses
I have redacted the IPv6 address, but it is exactly the same in all log
entries. I have also redacted the domains. The VPN provides
example.com and example.org, and lan.example.net is my LAN. This part
of the log looks exactly the same in 2.86 and 2.87; only the timestamps
change.
Here is what dnsmasq 2.86 reports when I disconnect the VPN:
Oct 9 16:40:43 dnsmasq[105349]: setting upstream servers from DBus
Oct 9 16:40:43 dnsmasq[105349]: using nameserver 192.168.1.1#53
Oct 9 16:40:43 dnsmasq[105349]: using nameserver fd...::1#53
Oct 9 16:40:43 dnsmasq[105349]: using nameserver 192.168.1.1#53 for
domain lan.example.net
Oct 9 16:40:43 dnsmasq[105349]: using nameserver fd...::1#53 for domain
lan.example.net
Oct 9 16:40:43 dnsmasq[105349]: read /etc/hosts - 0 addresses
Here is what dnsmasq 2.87 reports when I disconnect the VPN:
Oct 9 16:46:21 dnsmasq[105730]: setting upstream servers from DBus
Oct 9 16:46:21 dnsmasq[105730]: using nameserver 192.168.1.1#53 for
domain lan.example.net
Oct 9 16:46:21 dnsmasq[105730]: using nameserver fd...::1#53 for domain
lan.example.net
Oct 9 16:46:21 dnsmasq[105730]: read /etc/hosts - 0 addresses
Oct 9 16:46:22 dnsmasq[105730]: query[A] ipv4only.arpa from ::1
Oct 9 16:46:22 dnsmasq[105730]: config error is REFUSED (EDE: not ready)
Notice that 2.87 does not show any "using nameserver" lines that don't
also say "for domain". As a result, I can only look up hosts under the
lan.example.net domain. Everything else is refused.
I don't know how to see the DBus messages that openresolv is sending to
dnsmasq, but I would assume they're the same in both cases. The only
thing that changed is the version of dnsmasq. But for whatever reason,
dnsmasq 2.87 isn't setting up generic nameservers when the VPN
disconnects, but 2.86 is.
_______________________________________________
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
