Hi Prakash,

Thanks for confirming what I thought I needed to do.  I didn’t think about 
using iptables… the first thought I had was that I needed to have static route 
for the DNS server on the management network, and you confirmed that.  I guess 
I was hoping dnsmasq had some magic up its sleeve, but it doesn’t sound like 
it. 😊

I appreciate you taking the time to respond..

Best Regards,

John

From: Prakash Jayaraman <prak...@gmail.com>
Sent: Wednesday, June 3, 2020 1:58 PM
To: John Knight <john.kni...@belkin.com>
Cc: dnsmasq-discuss@lists.thekelleys.org.uk
Subject: Re: [Dnsmasq-discuss] How to use dnsmasq in a multi-wan environment??

>> My question is how does dnsmasq locate the upstream dns servers on the two 
>> different wan interfaces??  How does it know which interfaces it should use? 
>>  Is there some configuration I should have to tell dnsmasq to also use the 
>> management wan interface to find upstream dns?  Since the default route 
>> points to the data network’s wan interface, any upstream traffic sent by 
>> dnsmasq will go out the data network’s wan interface by default… how would 
>> dnsmasq send to upstream dns server on management wan interface?  How does 
>> the routing occur to the management wan interface?

There is a dnsmasq configuration that lets you pick a set of DNS servers for a 
given list of domains. So, if you have a domain for the management network, you 
can tell DNSmasq to contact the DNS-server for the management network when a 
query is made for some host on that network.  This kind of configuration is 
very common not only for the situation you have mentioned, but also because in 
some cases, for security reasons, you do not want DNS queries for some private 
domains going out of your organization. If you don't list any domain name in 
the 'server=' configuration, those servers are contacted for all domains.

Secondly, if you have multiple WANs, you are likely to get DNS servers from the 
DHCP server on each of the WANs (i.e. you have two different ISPs, one for 
backup/etc). What you need to do on your DHCP client is to write hooks so that 
traffic to a DNS server gets forwarded to the interface where it was known from 
(i.e. advertised by the DHCP server on that interface). Your hook should create 
host-specific static routes.  Some folks write IPtables rules and not static 
routes esp when there are a dozen other policies to work with. There are also 
quite a few cases where the DNS servers advertised by one ISP are simply not 
reachable through another ISP.

WIth the combination of the dnsmasq configuration and the static 
routes/iptables policies, you can accomplish what you want.

-prakash






On Wed, Jun 3, 2020 at 11:37 AM John Knight 
<john.kni...@belkin.com<mailto:john.kni...@belkin.com>> wrote:
Hi,

I am trying to understand how dnsmasq works and is configured for use in a 
multi-wan environment, where there are two networks/interfaces, one for 
internet access (public) and one for a management network (private).

In my router, the default route points to the data network.  There is no static 
route to access the management network.  What I want to do is establish a 
static route to the ACS server on the management network; all I have for the 
ACS Server is a URL.  The ACS server would NOT be in the dns database on the 
data network side, but as I understand it would be in the dns database on the 
management network… this is done for security reasons.  I need DNS to resolve 
the name in the URL to its IP Address.

My question is how does dnsmasq locate the upstream dns servers on the two 
different wan interfaces??  How does it know which interfaces it should use?  
Is there some configuration I should have to tell dnsmasq to also use the 
management wan interface to find upstream dns?  Since the default route points 
to the data network’s wan interface, any upstream traffic sent by dnsmasq will 
go out the data network’s wan interface by default… how would dnsmasq send to 
upstream dns server on management wan interface?  How does the routing occur to 
the management wan interface?

We have a working dnsmasq configuration for a single wan environment… what I am 
hoping to learn is what needs to be done to our configuration of dnsmasq to 
make it also work in multi-wan environment… and of course, if I can learn a 
little on how it works in this environment, I would be very grateful.

Thanks in advance for your help with this,

Regards,
JOHN KNIGHT

__________________________________________________________________ Confidential 
This e-mail and any files transmitted with it are the property of Belkin 
International, Inc. and/or its affiliates, are confidential, and are intended 
solely for the use of the individual or entity to whom this e-mail is 
addressed. If you are not one of the named recipients or otherwise have reason 
to believe that you have received this e-mail in error, please notify the 
sender and delete this message immediately from your computer. Any other use, 
retention, dissemination, forwarding, printing or copying of this e-mail is 
strictly prohibited. Pour la version française: 
http://www.belkin.com/email-notice/French.html<http://www.belkin.com/email-notice/French.html>
 Für die deutsche Übersetzung: 
http://www.belkin.com/email-notice/German.html<http://www.belkin.com/email-notice/German.html>
 __________________________________________________________________
_______________________________________________
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk<mailto:Dnsmasq-discuss@lists.thekelleys.org.uk>
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss<http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss>
__________________________________________________________________ Confidential 
This e-mail and any files transmitted with it are the property of Belkin 
International, Inc. and/or its affiliates, are confidential, and are intended 
solely for the use of the individual or entity to whom this e-mail is 
addressed. If you are not one of the named recipients or otherwise have reason 
to believe that you have received this e-mail in error, please notify the 
sender and delete this message immediately from your computer. Any other use, 
retention, dissemination, forwarding, printing or copying of this e-mail is 
strictly prohibited. Pour la version française: 
http://www.belkin.com/email-notice/French.html Für die deutsche Übersetzung: 
http://www.belkin.com/email-notice/German.html 
__________________________________________________________________
_______________________________________________
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss

Reply via email to