[Dnsmasq-discuss] reply /etc/hosts entry matching to interface

[Simon Kelley]

Joerg Habenicht wrote:
> Hello all,
> 
> isn't the option "localise-queries" used to return the matching address only?
> 
> 
> At home I got a gateway with 3 interfaces ppp0, eth0, eth1
> with 192.168.2.0/24 on eth0
>   and 192.168.1.0/24 on eth1
> with dnsmasq serving the DNS requests and listening on eth0 and eth1
> (and lo)
> 
> 
> The /etc/hosts looks like this:
> # intern net:
> 192.168.2.1     minime.mydomain.lan        minime
> ...
> # DMZ net:
> 192.168.1.1     minime.mydomain.lan        minime
> 192.168.1.2     jarrel.mydomain.lan        jarrel
> ...
> 
> 
> so if I do a "host" call on jarrel I get:
> $ host minime
> minime.mydomain.lan has address 192.168.2.1
> 
> but I would like to get address 192.168.1.1 as an answer from dnsmasq
> since returning 192.168.2.1 makes sshd nervous on jarrel.
> 
> Apr  6 13:10:57 jarrel sshd[6536]: Address 192.168.1.1 maps to 
> minime.mydomain.lan, but this does not map back to the address - POSSIBLE 
> BREAKIN ATTEMPT!
> 
> 

Look at the DNS configuration of jarrel: dnsmasq does the filtering 
based on the destination that the DNS request was sent to, _not_ the 
interface is was received on, so if you have the nameserver address in 
/etc/resolv.conf on jarrel set as 192.168.2.1 then dnsmasq will return 
the address on the 192.168.2.x network.

Example: my router box is called "central" and has addresses 192.168.0.4 
and 192.168.1.1. Both of those are in /etc/hosts.
It's possible to access central from a machine on the 192.168.1.1 
network using either of these addresses (thanks to a default route) but 
the DNS answers are different depending on which address the query is 
sent to. localise-queries is on.

srk at vaio:~$ host central 192.168.0.4
Using domain server:
Name: 192.168.0.4
Address: 192.168.0.4#53
Aliases:

central has address 192.168.0.4

srk at vaio:~$ host central 192.168.1.1
Using domain server:
Name: 192.168.1.1
Address: 192.168.1.1#53
Aliases:

central has address 192.168.1.1

The justification for doing it this way is that it makes the results 
consistent, and not dependent on routing changes in more complex networks.

HTH


Simon.