<div dir="ltr"><div>>> My question is how does dnsmasq locate the upstream dns servers on the
two different wan interfaces?? How does it know which interfaces it
should use? Is there some configuration I should have to tell dnsmasq
to also use the management
wan interface to find upstream dns? Since the default route points to
the data network’s wan interface, any upstream traffic sent by dnsmasq
will go out the data network’s wan interface by default… how would
dnsmasq send to upstream dns server on management
wan interface? How does the routing occur to the management wan
interface? <br></div><div><br></div><div>There is a dnsmasq configuration that lets you pick a set of DNS servers for a given list of domains. So, if you have a domain for the management network, you can tell DNSmasq to contact the DNS-server for the management network when a query is made for some host on that network. This kind of configuration is very common not only for the situation you have mentioned, but also because in some cases, for security reasons, you do not want DNS queries for some private domains going out of your organization. If you don't list any domain name in the 'server=' configuration, those servers are contacted for all domains.<br></div><div><br></div><div>Secondly, if you have multiple WANs, you are likely to get DNS servers from the DHCP server on each of the WANs (i.e. you have two different ISPs, one for backup/etc). What you need to do on your DHCP client is to write hooks so that traffic to a DNS server gets forwarded to the interface where it was known from (i.e. advertised by the DHCP server on that interface). Your hook should create host-specific static routes. Some folks write IPtables rules and not static routes esp when there are a dozen other policies to work with. There are also quite a few cases where the DNS servers advertised by one ISP are simply not reachable through another ISP. <br></div><div><br></div><div>WIth the combination of the dnsmasq configuration and the static routes/iptables policies, you can accomplish what you want.</div><div><br></div><div>-prakash<br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jun 3, 2020 at 11:37 AM John Knight <<a href="mailto:John.Knight@belkin.com">John.Knight@belkin.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_2142656420921063906WordSection1">
<p class="MsoNormal">Hi,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am trying to understand how dnsmasq works and is configured for use in a multi-wan environment, where there are two networks/interfaces, one for internet access (public) and one for a management network (private).<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">In my router, the default route points to the data network. There is no static route to access the management network. What I want to do is establish a static route to the ACS server on the management network; all I have for the ACS Server
is a URL. The ACS server would NOT be in the dns database on the data network side, but as I understand it would be in the dns database on the management network… this is done for security reasons. I need DNS to resolve the name in the URL to its IP Address.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My question is how does dnsmasq locate the upstream dns servers on the two different wan interfaces?? How does it know which interfaces it should use? Is there some configuration I should have to tell dnsmasq to also use the management
wan interface to find upstream dns? Since the default route points to the data network’s wan interface, any upstream traffic sent by dnsmasq will go out the data network’s wan interface by default… how would dnsmasq send to upstream dns server on management
wan interface? How does the routing occur to the management wan interface?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We have a working dnsmasq configuration for a single wan environment… what I am hoping to learn is what needs to be done to our configuration of dnsmasq to make it also work in multi-wan environment… and of course, if I can learn a little
on how it works in this environment, I would be very grateful. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks in advance for your help with this,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Regards,<u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:9pt;font-family:"Arial",sans-serif;color:black">JOHN KNIGHT </span></b><span style="font-size:9pt;font-family:"Arial",sans-serif;color:black"><br>
<br>
</span><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
__________________________________________________________________ Confidential This e-mail and any files transmitted with it are the property of Belkin International, Inc. and/or its affiliates, are confidential, and are intended solely for the use of the
individual or entity to whom this e-mail is addressed. If you are not one of the named recipients or otherwise have reason to believe that you have received this e-mail in error, please notify the sender and delete this message immediately from your computer.
Any other use, retention, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. Pour la version française: <a href="http://www.belkin.com/email-notice/French.html" target="_blank">http://www.belkin.com/email-notice/French.html</a> Für die deutsche Übersetzung: <a href="http://www.belkin.com/email-notice/German.html" target="_blank">http://www.belkin.com/email-notice/German.html</a>
__________________________________________________________________
</div>
_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss</a><br>
</blockquote></div>