<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi Prakash,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks for confirming what I thought I needed to do. I didn’t think about using iptables… the first thought I had was that I needed to have static route for the DNS server on the management network, and you confirmed that. I guess I was
hoping dnsmasq had some magic up its sleeve, but it doesn’t sound like it. <span style="font-family:"Segoe UI Emoji",sans-serif">
😊</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I appreciate you taking the time to respond..<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best Regards,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">John<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>From:</b> Prakash Jayaraman <prakarp@gmail.com> <br>
<b>Sent:</b> Wednesday, June 3, 2020 1:58 PM<br>
<b>To:</b> John Knight <John.Knight@belkin.com><br>
<b>Cc:</b> dnsmasq-discuss@lists.thekelleys.org.uk<br>
<b>Subject:</b> Re: [Dnsmasq-discuss] How to use dnsmasq in a multi-wan environment??<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">>> My question is how does dnsmasq locate the upstream dns servers on the two different wan interfaces?? How does it know which interfaces it should use? Is there some configuration I should have to tell dnsmasq to also use the management
wan interface to find upstream dns? Since the default route points to the data network’s wan interface, any upstream traffic sent by dnsmasq will go out the data network’s wan interface by default… how would dnsmasq send to upstream dns server on management
wan interface? How does the routing occur to the management wan interface? <o:p>
</o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There is a dnsmasq configuration that lets you pick a set of DNS servers for a given list of domains. So, if you have a domain for the management network, you can tell DNSmasq to contact the DNS-server for the management network when a
query is made for some host on that network. This kind of configuration is very common not only for the situation you have mentioned, but also because in some cases, for security reasons, you do not want DNS queries for some private domains going out of your
organization. If you don't list any domain name in the 'server=' configuration, those servers are contacted for all domains.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Secondly, if you have multiple WANs, you are likely to get DNS servers from the DHCP server on each of the WANs (i.e. you have two different ISPs, one for backup/etc). What you need to do on your DHCP client is to write hooks so that traffic
to a DNS server gets forwarded to the interface where it was known from (i.e. advertised by the DHCP server on that interface). Your hook should create host-specific static routes. Some folks write IPtables rules and not static routes esp when there are a
dozen other policies to work with. There are also quite a few cases where the DNS servers advertised by one ISP are simply not reachable through another ISP.
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">WIth the combination of the dnsmasq configuration and the static routes/iptables policies, you can accomplish what you want.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">-prakash<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Jun 3, 2020 at 11:37 AM John Knight <<a href="mailto:John.Knight@belkin.com">John.Knight@belkin.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I am trying to understand how dnsmasq works and is configured for use in a multi-wan environment, where there are two networks/interfaces, one for internet access (public) and one
for a management network (private).<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">In my router, the default route points to the data network. There is no static route to access the management network. What I want to do is establish a static route to the ACS
server on the management network; all I have for the ACS Server is a URL. The ACS server would NOT be in the dns database on the data network side, but as I understand it would be in the dns database on the management network… this is done for security reasons.
I need DNS to resolve the name in the URL to its IP Address.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">My question is how does dnsmasq locate the upstream dns servers on the two different wan interfaces?? How does it know which interfaces it should use? Is there some configuration
I should have to tell dnsmasq to also use the management wan interface to find upstream dns? Since the default route points to the data network’s wan interface, any upstream traffic sent by dnsmasq will go out the data network’s wan interface by default…
how would dnsmasq send to upstream dns server on management wan interface? How does the routing occur to the management wan interface?<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We have a working dnsmasq configuration for a single wan environment… what I am hoping to learn is what needs to be done to our configuration of dnsmasq to make it also work in
multi-wan environment… and of course, if I can learn a little on how it works in this environment, I would be very grateful.
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks in advance for your help with this,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Regards,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:black">JOHN KNIGHT </span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<p class="MsoNormal">__________________________________________________________________ Confidential This e-mail and any files transmitted with it are the property of Belkin International, Inc. and/or its affiliates, are confidential, and are intended solely
for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipients or otherwise have reason to believe that you have received this e-mail in error, please notify the sender and delete this message immediately
from your computer. Any other use, retention, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. Pour la version française:
<a href="http://www.belkin.com/email-notice/French.html" target="_blank">
http://www.belkin.com/email-notice/French.html</a> Für die deutsche Übersetzung: <a href="http://www.belkin.com/email-notice/German.html" target="_blank">
http://www.belkin.com/email-notice/German.html</a> __________________________________________________________________
<o:p></o:p></p>
</div>
<p class="MsoNormal">_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" target="_blank">http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss</a><o:p></o:p></p>
</blockquote>
</div>
</div>
__________________________________________________________________ Confidential This e-mail and any files transmitted with it are the property of Belkin International, Inc. and/or its affiliates, are confidential, and are intended solely for the use of the
individual or entity to whom this e-mail is addressed. If you are not one of the named recipients or otherwise have reason to believe that you have received this e-mail in error, please notify the sender and delete this message immediately from your computer.
Any other use, retention, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. Pour la version française: http://www.belkin.com/email-notice/French.html Für die deutsche Übersetzung: http://www.belkin.com/email-notice/German.html
__________________________________________________________________
</body>
</html>