Re: [Dnsmasq-discuss] How to use dnsmasq in a multi-wan environment??
Hi Prakash, Thanks for confirming what I thought I needed to do. I didn’t think about using iptables… the first thought I had was that I needed to have static route for the DNS server on the management network, and you confirmed that. I guess I was hoping dnsmasq had some magic up its sleeve, but it doesn’t sound like it. I appreciate you taking the time to respond.. Best Regards, John From: Prakash Jayaraman Sent: Wednesday, June 3, 2020 1:58 PM To: John Knight Cc: dnsmasq-discuss@lists.thekelleys.org.uk Subject: Re: [Dnsmasq-discuss] How to use dnsmasq in a multi-wan environment?? >> My question is how does dnsmasq locate the upstream dns servers on the two >> different wan interfaces?? How does it know which interfaces it should use? >> Is there some configuration I should have to tell dnsmasq to also use the >> management wan interface to find upstream dns? Since the default route >> points to the data network’s wan interface, any upstream traffic sent by >> dnsmasq will go out the data network’s wan interface by default… how would >> dnsmasq send to upstream dns server on management wan interface? How does >> the routing occur to the management wan interface? There is a dnsmasq configuration that lets you pick a set of DNS servers for a given list of domains. So, if you have a domain for the management network, you can tell DNSmasq to contact the DNS-server for the management network when a query is made for some host on that network. This kind of configuration is very common not only for the situation you have mentioned, but also because in some cases, for security reasons, you do not want DNS queries for some private domains going out of your organization. If you don't list any domain name in the 'server=' configuration, those servers are contacted for all domains. Secondly, if you have multiple WANs, you are likely to get DNS servers from the DHCP server on each of the WANs (i.e. you have two different ISPs, one for backup/etc). What you need to do on your DHCP client is to write hooks so that traffic to a DNS server gets forwarded to the interface where it was known from (i.e. advertised by the DHCP server on that interface). Your hook should create host-specific static routes. Some folks write IPtables rules and not static routes esp when there are a dozen other policies to work with. There are also quite a few cases where the DNS servers advertised by one ISP are simply not reachable through another ISP. WIth the combination of the dnsmasq configuration and the static routes/iptables policies, you can accomplish what you want. -prakash On Wed, Jun 3, 2020 at 11:37 AM John Knight mailto:john.kni...@belkin.com>> wrote: Hi, I am trying to understand how dnsmasq works and is configured for use in a multi-wan environment, where there are two networks/interfaces, one for internet access (public) and one for a management network (private). In my router, the default route points to the data network. There is no static route to access the management network. What I want to do is establish a static route to the ACS server on the management network; all I have for the ACS Server is a URL. The ACS server would NOT be in the dns database on the data network side, but as I understand it would be in the dns database on the management network… this is done for security reasons. I need DNS to resolve the name in the URL to its IP Address. My question is how does dnsmasq locate the upstream dns servers on the two different wan interfaces?? How does it know which interfaces it should use? Is there some configuration I should have to tell dnsmasq to also use the management wan interface to find upstream dns? Since the default route points to the data network’s wan interface, any upstream traffic sent by dnsmasq will go out the data network’s wan interface by default… how would dnsmasq send to upstream dns server on management wan interface? How does the routing occur to the management wan interface? We have a working dnsmasq configuration for a single wan environment… what I am hoping to learn is what needs to be done to our configuration of dnsmasq to make it also work in multi-wan environment… and of course, if I can learn a little on how it works in this environment, I would be very grateful. Thanks in advance for your help with this, Regards, JOHN KNIGHT __ Confidential This e-mail and any files transmitted with it are the property of Belkin International, Inc. and/or its affiliates, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipients or otherwise have reason to believe that you have received this e-mail in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding,
Re: [Dnsmasq-discuss] How to use dnsmasq in a multi-wan environment??
>> My question is how does dnsmasq locate the upstream dns servers on the two different wan interfaces?? How does it know which interfaces it should use? Is there some configuration I should have to tell dnsmasq to also use the management wan interface to find upstream dns? Since the default route points to the data network’s wan interface, any upstream traffic sent by dnsmasq will go out the data network’s wan interface by default… how would dnsmasq send to upstream dns server on management wan interface? How does the routing occur to the management wan interface? There is a dnsmasq configuration that lets you pick a set of DNS servers for a given list of domains. So, if you have a domain for the management network, you can tell DNSmasq to contact the DNS-server for the management network when a query is made for some host on that network. This kind of configuration is very common not only for the situation you have mentioned, but also because in some cases, for security reasons, you do not want DNS queries for some private domains going out of your organization. If you don't list any domain name in the 'server=' configuration, those servers are contacted for all domains. Secondly, if you have multiple WANs, you are likely to get DNS servers from the DHCP server on each of the WANs (i.e. you have two different ISPs, one for backup/etc). What you need to do on your DHCP client is to write hooks so that traffic to a DNS server gets forwarded to the interface where it was known from (i.e. advertised by the DHCP server on that interface). Your hook should create host-specific static routes. Some folks write IPtables rules and not static routes esp when there are a dozen other policies to work with. There are also quite a few cases where the DNS servers advertised by one ISP are simply not reachable through another ISP. WIth the combination of the dnsmasq configuration and the static routes/iptables policies, you can accomplish what you want. -prakash On Wed, Jun 3, 2020 at 11:37 AM John Knight wrote: > Hi, > > > > I am trying to understand how dnsmasq works and is configured for use in a > multi-wan environment, where there are two networks/interfaces, one for > internet access (public) and one for a management network (private). > > > > In my router, the default route points to the data network. There is no > static route to access the management network. What I want to do is > establish a static route to the ACS server on the management network; all I > have for the ACS Server is a URL. The ACS server would NOT be in the dns > database on the data network side, but as I understand it would be in the > dns database on the management network… this is done for security reasons. > I need DNS to resolve the name in the URL to its IP Address. > > > > My question is how does dnsmasq locate the upstream dns servers on the two > different wan interfaces?? How does it know which interfaces it should > use? Is there some configuration I should have to tell dnsmasq to also use > the management wan interface to find upstream dns? Since the default route > points to the data network’s wan interface, any upstream traffic sent by > dnsmasq will go out the data network’s wan interface by default… how would > dnsmasq send to upstream dns server on management wan interface? How does > the routing occur to the management wan interface? > > > > We have a working dnsmasq configuration for a single wan environment… what > I am hoping to learn is what needs to be done to our configuration of > dnsmasq to make it also work in multi-wan environment… and of course, if I > can learn a little on how it works in this environment, I would be very > grateful. > > > > Thanks in advance for your help with this, > > > > Regards, > > *JOHN KNIGHT * > > > __ > Confidential This e-mail and any files transmitted with it are the property > of Belkin International, Inc. and/or its affiliates, are confidential, and > are intended solely for the use of the individual or entity to whom this > e-mail is addressed. If you are not one of the named recipients or > otherwise have reason to believe that you have received this e-mail in > error, please notify the sender and delete this message immediately from > your computer. Any other use, retention, dissemination, forwarding, > printing or copying of this e-mail is strictly prohibited. Pour la version > française: http://www.belkin.com/email-notice/French.html Für die > deutsche Übersetzung: http://www.belkin.com/email-notice/German.html > __ > ___ > Dnsmasq-discuss mailing list > Dnsmasq-discuss@lists.thekelleys.org.uk > http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss > ___ Dnsmasq-discuss mailing list Dnsmasq-discuss@lists.thekelleys.org.uk
Re: [Dnsmasq-discuss] How to use dnsmasq in a multi-wan environment??
On 6/3/2020 8:22 PM, John Knight wrote: Hi, I am trying to understand how dnsmasq works and is configured for use in a multi-wan environment, where there are two networks/interfaces, one for internet access (public) and one for a management network (private). In my router, the default route points to the data network. There is no static route to access the management network. What I want to do is establish a static route to the ACS server on the management network; all I have for the ACS Server is a URL. The ACS server would NOT be in the dns database on the data network side, but as I understand it would be in the dns database on the management network... this is done for security reasons. I need DNS to resolve the name in the URL to its IP Address. My question is how does dnsmasq locate the upstream dns servers on the two different wan interfaces?? How does it know which interfaces it should use? Is there some configuration I should have to tell dnsmasq to also use the management wan interface to find upstream dns? Since the default route points to the data network's wan interface, any upstream traffic sent by dnsmasq will go out the data network's wan interface by default... how would dnsmasq send to upstream dns server on management wan interface? How does the routing occur to the management wan interface? We have a working dnsmasq configuration for a single wan environment... what I am hoping to learn is what needs to be done to our configuration of dnsmasq to make it also work in multi-wan environment... and of course, if I can learn a little on how it works in this environment, I would be very grateful. Thanks in advance for your help with this, Unless I'm missing something, most of your questions are deeling with the DHCP client and not with Dnsmasq per say. -- John Doe ___ Dnsmasq-discuss mailing list Dnsmasq-discuss@lists.thekelleys.org.uk http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
[Dnsmasq-discuss] How to use dnsmasq in a multi-wan environment??
Hi, I am trying to understand how dnsmasq works and is configured for use in a multi-wan environment, where there are two networks/interfaces, one for internet access (public) and one for a management network (private). In my router, the default route points to the data network. There is no static route to access the management network. What I want to do is establish a static route to the ACS server on the management network; all I have for the ACS Server is a URL. The ACS server would NOT be in the dns database on the data network side, but as I understand it would be in the dns database on the management network... this is done for security reasons. I need DNS to resolve the name in the URL to its IP Address. My question is how does dnsmasq locate the upstream dns servers on the two different wan interfaces?? How does it know which interfaces it should use? Is there some configuration I should have to tell dnsmasq to also use the management wan interface to find upstream dns? Since the default route points to the data network's wan interface, any upstream traffic sent by dnsmasq will go out the data network's wan interface by default... how would dnsmasq send to upstream dns server on management wan interface? How does the routing occur to the management wan interface? We have a working dnsmasq configuration for a single wan environment... what I am hoping to learn is what needs to be done to our configuration of dnsmasq to make it also work in multi-wan environment... and of course, if I can learn a little on how it works in this environment, I would be very grateful. Thanks in advance for your help with this, Regards, JOHN KNIGHT __ Confidential This e-mail and any files transmitted with it are the property of Belkin International, Inc. and/or its affiliates, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipients or otherwise have reason to believe that you have received this e-mail in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. Pour la version fran?aise: http://www.belkin.com/email-notice/French.html F?r die deutsche ?bersetzung: http://www.belkin.com/email-notice/German.html __ ___ Dnsmasq-discuss mailing list Dnsmasq-discuss@lists.thekelleys.org.uk http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
