[Dnsmasq-discuss] restricting dnsmasq listen addresses
simon at thekelleys.org.uk
Mon Apr 9 22:07:20 BST 2007
Carla Schroder wrote:
> I want to limit dnsmasq to listen only on my LAN interfaces, but right now
> it's open to the world. This is my conf:
> #dnsmasq use own dns server
> #listen only on LAN addresses
> #upstream servers
> But both netstat and nmap confirm that Dnsmasq is listening to all interfaces,
> as this netstat output shows:
> # netstat -untap
> Active Internet connections (servers and established)
> Proto Recv-Q Send-Q Local Address Foreign Address State
> PID/Program name
> tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN
> tcp6 0 0 :::53 :::* LISTEN
> udp 0 0 0.0.0.0:53 0.0.0.0:*
> udp 0 0 0.0.0.0:67 0.0.0.0:*
> udp6 0 0 :::53 :::*
> Nmap, run from a remote host with my firewall turned off, confirms that DNS is
> open to the world:
> PORT STATE SERVICE
> 53/tcp open domain
> Or it would be, without my nice iptables firewall.
> I have tried using various combinations of options, like
> But it still listens to all interfaces and addresses. Any ideas how to make it
> listen only on certain interfaces or addresses?
By default, dnsmasq rejects DNS queries in user space, not the kernel.
Nmap may think that DNS is open to the world, but DNS requests from the
world will be dropped.
If you want to have the kernel do the access control instead of dnsmasq
itself, use the "bind-interfaces" flag.
More information about the Dnsmasq-discuss