<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Console";
panose-1:2 11 6 9 4 5 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"> I am new to using dnsmasq as we had an idea of using it to intercept DNS requests on our firewalls, but we are having an issue with it that we have been trying to resolve for over a day now. What our goal is, is to use conntrack marks
to mark different requests with a different tag within dnsmasq. This is working great if we are specifying the firewall as the dns server. The issue is when we are using an external DNS server and transparently redirecting it to dnsmasq then the mark cannot
be read.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For instance if on the client I do this<o:p></o:p></p>
<p class="MsoNormal">$ nslookup -port=5353<o:p></o:p></p>
<p class="MsoNormal">> server 192.168.0.1<o:p></o:p></p>
<p class="MsoNormal">Default server: 192.168.0.1<o:p></o:p></p>
<p class="MsoNormal">Address: 192.168.0.1#5353<o:p></o:p></p>
<p class="MsoNormal">> test.com<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the firewall I have a mangle rule to mark the packets and my debug output for dnsmasq shows the following.<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Lucida Console"">dnsmasq: Client 192.168.0.104, Conn_Mark: 8193, requested: test.com<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">But when simply doing this from the client<o:p></o:p></p>
<p class="MsoNormal">$ nslookup <o:p></o:p></p>
<p class="MsoNormal">> server 8.8.8.8<o:p></o:p></p>
<p class="MsoNormal">Default server: 8.8.8.8<o:p></o:p></p>
<p class="MsoNormal">Address: 8.8.8.8#53<o:p></o:p></p>
<p class="MsoNormal">> test.com<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Where I have an iptables redirect rule I receive the following error<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">dnsmasq: Conntrack connection mark retrieval failed: No such file or directory<o:p></o:p></p>
<p class="MsoNormal">dnsmasq: Client 192.168.0.104, Conn_Mark: 104, requested: test.com<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I cannot seem to figure out what the error really means since no such file or directory really doesn’t make any sense. Are there any suggestions as to what might be causing this and any solutions that anyone can think of?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Jeff Albert<o:p></o:p></p>
<p class="MsoNormal">Senior Software Developer, Addition Networks<span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>