One small addendum to my previous post: if using a DHCP-helper, it is mandatory to include the netmask in the dhcp-range option. For directly-connected networks dnsmasq works this out for itself, but for remote networks it cannot. Cheers, Simon.