14

It was well known that NetworkManager does not play well with dnsmasq (ref: here). I've skimmed throught the lengthy discussion here but still not sure what the recommended way to deal with the situation is.

All that I want is to do is to use dnsmasq to provide DNS and DHCP to my local network. What would be the recommended way in this case?

It seems the problem remains even for Ubuntu 14.04, even the bug is claimed to be fixed.

As work arounds, people are disabling the NM-enslaved dnsmasq-base because the following reasons:

The NM-enslaved dnsmasq uses hardcoded options (in C) that provide extremely limited functionality.

  • It doesn't listen on ethX (--listen-address=127.0.0.1). So we can't use our servers as DNS servers for our local network PCs, i.e. it's completely useless for LANs.
  • It doesn't cache requests (--cache-size=0). No caching ==> no DNS queries speedup. This again is very significant for LANs as there are many concurrent users.
  • Finally, we also need the DHCP and TFTP functionality of dnsmasq, so even if NM+dnsmasq included a real DNS server, we'd have to run another dnsmasq

But I'm not sure if they still holds and/or how the fix has solve the problem(s). Further, none of them are very clear exactly what they did and how they did to solve their problem. I.e., the solution part is missing from the lengthy discussion. Can someone fill in the blanks please? I.e.,

The dnsmasq provided out-of-box by Ubuntu is not working, on the server side, for the above reasons. And also, on the client side, "the dnsmasq installed on those Ubuntu laptops cannot do LAN DNS query from my DNS server", because "the (Ubuntu laptops') NetworkManager is causing them to have a weird 127.0.1.1 nameserver setting" (ref: DNS solution for LAN or local home network)

How to make dnsmasq to work smoothly with NetworkManager, so as to provide DNS and DHCP (and TFTP) to my local network, on both the server and client side?

TL'dr

for those seeking the answer. Of all the answers below, I found the simplest solution is @brad's, for the server side (still no good answer for the client side):

the only solution to the problem is to disable the NM-drive dnsmasq..., and install the "standard" dnsmasq and then configure it via its standard /etc/dnsmasq.conf configuration file.

3

I also have your problems.

In principle, after wiki.archlinux, it seems that to enable caching it should be enough to create a file /etc/NetworkManager/dnsmasq.d/cache containing simply

$ cat /etc/NetworkManager/dnsmasq.d/cache 
cache-size=1000

I tried this but, after NM restarted, I still have no cache:

# ps ax | grep dns
11724 ?        S      0:00 /usr/sbin/dnsmasq --no-resolv --keep-in-foreground --no-hosts --bind-interfaces --pid-file=/run/sendsigs.omit.d/network-manager.dnsmasq.pid --listen-address=127.0.1.1 --conf-file=/var/run/NetworkManager/dnsmasq.conf --cache-size=0 --proxy-dnssec --enable-dbus=org.freedesktop.NetworkManager.dnsmasq --conf-dir=/etc/NetworkManager/dnsmasq.d

Note that the cited conf-file is always empty: I have not been able to configure any option using this procedure.

All in all, it seems that the NM-enslaved dnsmask in 14.04 (which is provided by the dnsmasq-base package) is completely locked, so it is not possible to enable caching, nor anything else (dhcp, tftp).

If this is right I think that, as you say, the only solution to the problem is to disable the NM-drive dnsmasq by commenting out the line

dns=dnsmasq

in the file /etc/NetworkManager/NetworkManager.conf and install the "standard" dnsmasq and then configure it via its standard /etc/dnsmasq.conf configuration file.

  • Welcome to superuser brad! Thanks for your help! – xpt Sep 10 '14 at 15:28
  • 1
    Actually this does enable cache, since it's running with --conf-dir=/etc/NetworkManager/dnsmasq.d, the cache-size specified in the file you created is used. You can see the difference using dig – sirfz Aug 25 '16 at 23:16
6

It is possible to override settings by putting them into /etc/NetworkManager/dnsmasq.d/*.conf. Configuration file settings take precedence over command-line flags. They are applied when NetworkManager starts dnsmasq. Run sudo service network-manager restart to reapply. (If there's any doubt: brad's answer missed the fact that ps ax | grep dns shows a --conf-dir argument)

For example:

echo cache-size=1000 |sudo tee -a /etc/NetworkManager/dnsmasq.d/cache.conf

As I recall NetworkManager disables dnsmasq caching by default due to concerns over cache poisoning. For a machine where all users are trusted it may not be an issue.

NetworkManager doesn't integrate with resolvconf, and NM's server at 127.0.1.1 won't be used locally if the resolvconf package is installed. resolvconf is part of ubuntu-minimal and standard Debian installs; NetworkManager reimplements that functionality in a more integrated, less script-based way.

NetworkManager does make sure not to interfere with a global dnsmasq instance (binding to a secondary loopback IP and setting bind-interfaces through /etc/dnsmasq.d/network-manager). If you install a global dnsmasq instance and keep NM's instance, double check in /etc/resolv.conf to see which one the host will use by default.

While you can customise NetworkManager's dnsmasq instance as shown above, if you want a DNS server that binds to public interfaces, you should install the dnsmasq package (NetworkManager only uses dnsmasq-base, which doesn't configure a global instance) and put your configuration in /etc/dnsmasq.d/*.conf. NetworkManager's slave instance is only meant to bind to the loopback interface and configuring it beyond that scope would risk breaking it.


In summary, for someone who just wants local DNS caching:

sudo apt-get remove dnsmasq resolvconf dhcpcd5 rdnssd
echo cache-size=1000 |sudo tee -a /etc/NetworkManager/dnsmasq.d/cache.conf

For a simple LAN, NetworkManager's connection sharing should still suffice. But for a custom-configured LAN, with TFTP and so on:

sudo apt-get install resolvconf dnsmasq
echo 192.168.0.50,192.168.0.150,12h |sudo tee -a /etc/dnsmasq.d/lan.conf
echo enable-tftp |sudo tee -a /etc/dnsmasq.d/lan.conf
sudo service dnsmasq restart
  • Thanks. Though you should describe more fully what your "in summary" commands do, i.e. the instructions also remove 4 packages if you have them currently More links and discussion at reddit.com/r/Ubuntu/comments/2j0va4/… – nealmcb Apr 13 '17 at 16:37
  • Quite agree with @nealmcb, Tobu, please explain why "for someone who just wants local DNS caching", they need to remove the dnsmasq package. then what's the next echo command is for? since the dnsmasq will be gone. – xpt Jan 22 '18 at 3:15
  • @xpt Tobu suggests to remove dnsmasq, but you should still have dnsmasq-base installed due to NM. – Thalis Kalfigkopoulos Jun 6 '18 at 15:01
0

I wanted to assign a particular MAC to a particular IP address and for the purposes of stability, stick with the default Network Manager/dnsmasq as much as possible.

https://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/src/dnsmasq/nm-dnsmasq-manager.c does have the comment about using --conf-file to ignore configurations, but later in the file we have

/* dnsmasq exits if the conf dir is not present */
    if (g_file_test (CONFDIR, G_FILE_TEST_IS_DIR))
        nm_cmd_line_add_string (cmd, "--conf-dir=" CONFDIR);

Under Ubuntu 16.04 LTS, after setting up a Wi-Fi Hot Spot and sharing another connection, ps auxgww | grep dnsmasq shows that the last command line argument of each of the dnsmasq processes is:

--conf-dir=/etc/NetworkManager/dnsmasq-shared.d

Thus, it is possible to create config files in that directory that are shared amongst all the invocations of dnsmasq that are started by Network Manager.

I created /etc/NetworkManager/dnsmasq-shared.d/Hue

dhcp-host=0c:4d:e9:a0:ce:cf,192.168.1.221

and rebooted, though running

sudo service network-manager restart

would have worked.

This resulted in my device getting the appropriate IP address.

Yes, this is wrong because it means that all of the invocations of dnsmasq by NetworkManager will get this declaration, but in this case, it is harmless because it only matters if the MAC shows up on the network in question. If the network is not 192.168.1, then there will be trouble.

This is more robust than replacing /usr/sbin/dnsmasq with a script as is proposed at https://gist.github.com/magnetikonline/6236150

The right solution would be to modify how dnsmasq is invoked to properly use dnsmasq configuration files. I understand the desire to have Network Manager "just work", but making tools idiot-proof means that only idiots can use them.

  • thanks for the answer Christopher, however, I'm really not able to follow... "I wanted to assign a particular MAC to a particular IP address and for the purposes of stability"... "ps auxgww | grep dnsmasq shows that the last command line argument of each of the dnsmasq processes"... "I created ... would have worked"... "Yes, this is wrong"... I.e., I really can't follow your train of thought, to make sense what you are trying to say here. – xpt Jan 22 '18 at 3:23
0

My solution might break Network Manager and its keeping everything simple way of doing things. With NM's broken way of dealing with dnsmasq, I just override it with my method below.

A workaround to the problem was to simply do the following:

sudo apt install dnsmasq
cp /etc/dnsmasq.conf ~/

Edit the ~/dnsmasq.conf file in your user directory how you want it to be and save it.

sudo rm -v /etc/dnsmasq.conf
sudo cp -v ~/dnsmasq.conf /etc/
sudo chattr +i /etc/dnsmasq.conf
sudo systemctl restart dnsmasq.service

I made a simple bash alias and put it at the bottom of my ~/.bash_aliases file to make it easy to edit the dnsmasq.conf file. Here's the alias:

alias="sudo chattr -i /etc/dnsmasq.conf && sudo nano -w /etc/dnsmasq.conf && sudo chattr +i /etc/dnsmasq.conf && sudo systemctl restart dnsmasq.service"

Of course, you can choose any editor to your liking for the second sudo command in the alias, but I used nano there for ease for everyone. Save the file, close and reopen your command terminal tab/window. That should enable the alias to be available to newly opened terminal tabs/windows.

Simply run eddmc from your user account and it will ask for your password to perform the elevated commands.

Notice that I always chattr +i the file. This is so Network Manager won't overwrite your config with its own.

On wired ethernet connections there shouldn't be any problems. I have found since I use dnsmasq for dns caching on laptops with wireless that I have to manually restart the dnsmasq.service after connecting to an access point. I think Network Manager can perform tasks like restarting services when connecting, but I haven't looked into that yet.

0

Despite claims here and elsewhere to the contrary, NetworkManager completely ignores any and all dmsmasq configuration files – even those in its own directory /etc/NetworkManager/dnsmasq-shared.d. The proof is in the source code for NetworkManager... Here is the relevant comment:

/* dnsmasq may read from its default config file location, which if that location is a valid config file, it will combine with the options here and cause undesirable side-effects. Like sending bogus IP addresses as the gateway or whatever. So tell dnsmasq not to use any config file at all. */

Here is link to relevant source code (lines 139-144).

  • 2
    A link to point at the source code so that readers can validate this and read the associated code would be helpful if possible. – jamesc Jan 5 '18 at 17:25
  • So yes, one can not specify an explicit config file. --conf-file is hard coded to /dev/null. However, if you look at the full command line used to start dnsmasq via the NetworkManager you see that conf-dir is used: '/usr/sbin/dnsmasq --no-resolv --keep-in-foreground --no-hosts --bind-interfaces --pid-file=/var/run/NetworkManager/dnsmasq.pid --listen-address=127.0.0.1 --cache-size=400 --clear-on-reload --conf-file=/dev/null --proxy-dnssec --enable-dbus=org.freedesktop.NetworkManager.dnsmasq --conf-dir=/etc/NetworkManager/dnsmasq.d', meaning all the files in the given directory are read. – Hardy Sep 5 '18 at 8:30

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.