<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello, <br>
<br>
I have configured my dnsmasq server to provide both DHCP and DNS
services for my network, which includes <br>
a few VLANs. It works flawlessly, except that users on the guest
VLAN can do direct and reverse queries of <br>
machines on different VLANs, and obtain meaningful replies from
dnsmasq. <br>
<br>
While the above requires knowldege of the other VLANs' subnets
and/or the names of machines on more <br>
private, and of course iptables keeps good guard that no packets are
exchanged between the guest VLAN<br>
and the more private ones, I feel a determined attacker may easily
guess the other subnets, and possibly<br>
the names of some machines on the other VLANs, weakening my
configuration.<br>
<br>
<br>
Hence: can dnsmasq be configured to drop queries about different
private subnets? Thanks for your time.<br>
<br>
mario<br>
<br>
<br>
The backbone of my dnsmasq.conf follows:<br>
<br>
<br>
localise-queries<br>
domain-needed<br>
bogus-priv<br>
dhcp-authoritative<br>
no-dhcp-interface=tun0<br>
no-resolv<br>
stop-dns-rebind<br>
interface=eth0<br>
interface=eth0.10<br>
interface=eth0.20<br>
interface=eth0.30<br>
interface=tun0<br>
server=/GCTlab.lan/192.168.11.1<br>
local=/faculty.lan/students.lan/administration.lan/guest.lan/<br>
server=8.8.8.8<br>
server=8.8.4.4<br>
expand-hosts<br>
domain=faculty.lan,192.168.73.0/24<br>
domain=students.lan,10.0.73.0/24<br>
.....<br>
dhcp-range=interface:eth0,192.168.73.32,192.168.73.90,12h<br>
dhcp-range=interface:eth0.10,10.0.73.32,10.0.73.90,12h<br>
......<br>
<span style="color: rgb(36, 39, 41); font-family: Arial,
"Helvetica Neue", Helvetica, sans-serif; font-size:
15px; font-style: normal; font-variant-ligatures: normal;
font-variant-caps: normal; font-weight: normal; letter-spacing:
normal; orphans: 2; text-align: left; text-indent: 0px;
text-transform: none; white-space: normal; widows: 2;
word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); text-decoration-style:
initial; text-decoration-color: initial; display: inline
!important; float: none;"></span>
</body>
</html>