[Dnsmasq-discuss] How to use dnsmasq in a multi-wan environment??

[Prakash Jayaraman]

>> My question is how does dnsmasq locate the upstream dns servers on the
two different wan interfaces??  How does it know which interfaces it should
use?  Is there some configuration I should have to tell dnsmasq to also use
the management wan interface to find upstream dns?  Since the default route
points to the data network’s wan interface, any upstream traffic sent by
dnsmasq will go out the data network’s wan interface by default… how would
dnsmasq send to upstream dns server on management wan interface?  How does
the routing occur to the management wan interface?

There is a dnsmasq configuration that lets you pick a set of DNS servers
for a given list of domains. So, if you have a domain for the management
network, you can tell DNSmasq to contact the DNS-server for the management
network when a query is made for some host on that network.  This kind of
configuration is very common not only for the situation you have mentioned,
but also because in some cases, for security reasons, you do not want DNS
queries for some private domains going out of your organization. If you
don't list any domain name in the 'server=' configuration, those servers
are contacted for all domains.

Secondly, if you have multiple WANs, you are likely to get DNS servers from
the DHCP server on each of the WANs (i.e. you have two different ISPs, one
for backup/etc). What you need to do on your DHCP client is to write hooks
so that traffic to a DNS server gets forwarded to the interface where it
was known from (i.e. advertised by the DHCP server on that interface). Your
hook should create host-specific static routes.  Some folks write IPtables
rules and not static routes esp when there are a dozen other policies to
work with. There are also quite a few cases where the DNS servers
advertised by one ISP are simply not reachable through another ISP.

WIth the combination of the dnsmasq configuration and the static
routes/iptables policies, you can accomplish what you want.

-prakash






On Wed, Jun 3, 2020 at 11:37 AM John Knight <John.Knight at belkin.com> wrote:

> Hi,
>
>
>
> I am trying to understand how dnsmasq works and is configured for use in a
> multi-wan environment, where there are two networks/interfaces, one for
> internet access (public) and one for a management network (private).
>
>
>
> In my router, the default route points to the data network.  There is no
> static route to access the management network.  What I want to do is
> establish a static route to the ACS server on the management network; all I
> have for the ACS Server is a URL.  The ACS server would NOT be in the dns
> database on the data network side, but as I understand it would be in the
> dns database on the management network… this is done for security reasons.
> I need DNS to resolve the name in the URL to its IP Address.
>
>
>
> My question is how does dnsmasq locate the upstream dns servers on the two
> different wan interfaces??  How does it know which interfaces it should
> use?  Is there some configuration I should have to tell dnsmasq to also use
> the management wan interface to find upstream dns?  Since the default route
> points to the data network’s wan interface, any upstream traffic sent by
> dnsmasq will go out the data network’s wan interface by default… how would
> dnsmasq send to upstream dns server on management wan interface?  How does
> the routing occur to the management wan interface?
>
>
>
> We have a working dnsmasq configuration for a single wan environment… what
> I am hoping to learn is what needs to be done to our configuration of
> dnsmasq to make it also work in multi-wan environment… and of course, if I
> can learn a little on how it works in this environment, I would be very
> grateful.
>
>
>
> Thanks in advance for your help with this,
>
>
>
> Regards,
>
> *JOHN KNIGHT *
>
>
> __________________________________________________________________
> Confidential This e-mail and any files transmitted with it are the property
> of Belkin International, Inc. and/or its affiliates, are confidential, and
> are intended solely for the use of the individual or entity to whom this
> e-mail is addressed. If you are not one of the named recipients or
> otherwise have reason to believe that you have received this e-mail in
> error, please notify the sender and delete this message immediately from
> your computer. Any other use, retention, dissemination, forwarding,
> printing or copying of this e-mail is strictly prohibited. Pour la version
> française: http://www.belkin.com/email-notice/French.html Für die
> deutsche Übersetzung: http://www.belkin.com/email-notice/German.html
> __________________________________________________________________
> _______________________________________________
> Dnsmasq-discuss mailing list
> Dnsmasq-discuss at lists.thekelleys.org.uk
> http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/attachments/20200603/4e5ba87d/attachment-0001.html>