[Dnsmasq-discuss] Best way to handle dual-wans with dnsmasq (John Knight)

[Petr Mensik]

Hi John,

we are using kind of hack for similar purpose in dnssec-trigger package.
If udhcpc serves domain or search directives for resolv.conf, they can
be used to redirect just those domains to management servers. It can
work centrally managed. But requires special handling of search domains,
that is not usually done. Do not know whether udhcpc is capable such
configuration.

You would have to ask administrator to add some domain name into DHCP
offered. I doubt you can configure dnsmasq to query both servers. It
usually picks one fastest and stick to it until it responds. If the
management server does not provide full DNS resolver, it would not work.
How would it respond to addresses it does not know? NXDomain means
authoritative reply, no such domain exist. You should not ask other
server to confirm or deny that information. Is that management DNS
service dnsmasq based as well? Every other server requires some 'zone'
concept, that organizes names into domains and subdomains. Just dnsmasq
does not care and can serve whatever name it chooses.

I think some rule to distinguish management names and normal traffic has
to be made first.

Regards,
Petr

On 8/26/19 7:28 PM, John Knight wrote:
> Hi Petr,
> 
> I think what you are suggesting is to use server entry to define the IP Addresss corresponding to the domain name of the dns server on the management interface.  Unfortunately, in my case we use udhcpc to learn of the upstream dns server;s IP address.  There is no domain name for the management server... only an IP address.  The only thing I will know is that the xx.xx.xx.xx IP address I learned via udhcpc is on the management wan interface... I won't know its domain name.   So for any given dns request dnsmasq gets, dnsmasq will potentially need to query both wans (data and management) to resolve the IP address.  Is this possible to do?  It will NOT have a domain name to direct it to the right wan to query.
> 
> Thanks,
> 
> John
> 
> 
> From: John Knight
> Sent: Monday, August 26, 2019 10:07 AM
> To: dnsmasq-discuss at lists.thekelleys.org.uk
> Subject: Re: Best way to handle dual-wans with dnsmasq (John Knight)
> 
> Hi Petr,
> 
> In my situation with dual-wans, I am not too concerned about management network being accessible to  all users, so using a single dnsmasq is acceptable.  I am using dnsmasq to serve dhcp and dns requests on the data network, but it only needs to support dns requests on the management network.
> 
> What I have tried so far is to add the nameserver entries for both wans to resolv.conf.  However, I am seeing dns queries only go to the data wan... they are not going to the management wan.   How does dnsmasq know that nameserver xx.xx.xx.xx is on management wan, and nameserver yy.yy.yy.yy is on data wan... and how does dnsmasq know to query both wans for any given dns request?  I think what I had hoped is that dnsmasq would first query dns server upstream on the data wan, then if it did not resolve the address, it would then try to query the dns server on the management wan.
> 
> I know there is a listen address which I presume is somehow used to in essence route the request to a given wan, but I am not sure.  I think what I really need is an example on how to do this.
> 
> Thanks for your help with this.
> 
> John
> __________________________________________________________________ Confidential This e-mail and any files transmitted with it are the property of Belkin International, Inc. and/or its affiliates, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipients or otherwise have reason to believe that you have received this e-mail in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. Pour la version fran?aise: http://www.belkin.com/email-notice/French.html F?r die deutsche ?bersetzung: http://www.belkin.com/email-notice/German.html __________________________________________________________________
> 
> 
> _______________________________________________
> Dnsmasq-discuss mailing list
> Dnsmasq-discuss at lists.thekelleys.org.uk
> http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
> 

-- 
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
email: pemensik at redhat.com  PGP: 65C6C973