10

I'm running Debian Jessie and I'm trying to configure dnsmasq as a caching DNS server. I used a guide to come up with the following /etc/dnsmasq.conf:

listen-address=127.0.0.1
bind-interfaces
domain-needed
bogus-priv
no-hosts
dns-forward-max=150
cache-size=1000
neg-ttl=3600
resolv-file=/etc/resolv.dnsmasq
no-poll

Doing sudo service dnsmasq restart fails and it won't start, telling me

Mar 26 17:13:01 user dnsmasq[26743]: dnsmasq: syntax check OK.
Mar 26 17:13:01 user dnsmasq[26746]: dnsmasq: only one resolv.conf file allowed in no-poll mode.

Ok, kind of strange that a config straight out of a guide failed. I'll just remove the no-poll option to see if it works. This time it starts just fine, but DNS resolution is clearly failing. Relevant files:

/etc/resolv.conf:

nameserver 127.0.0.1

/etc/resolv.dnsmasq:

nameserver 8.8.8.8

/var/run/dnsmasq/resolv.conf:

nameserver 127.0.0.1

The third file appears to be dnsmasq's live resolv.conf file, because adding a nameserver line to it while dnsmasq is already running causes DNS resolution to immediate start working. So it looks like it ignored my /etc/resolv.dnsmasq. I also tried adding a nameserver line to my /etc/resolv.conf and removing the resolv-file line in /etc/dnsmasq.conf, but it gets overwritted immediately to what you see above upon doing sudo service dnsmasq restart.

What is going on with dnsmasq and do I configure dnsmasq as a caching DNS server?

Improve this question
3
  • 1
    If you just want a static server, why don't you put server=8.8.8.8 in your dnsmasq config? – tripleee Mar 26 '15 at 22:54
  • I'm thinking the no-poll basically says to ignore the resolv-file. At startup, it takes whichever file is newer, so that will be /etc/resolv.conf in your case (because it gets rewritten when something changes). – tripleee Mar 26 '15 at 23:01
  • I still don't know what the correct way to do it would be if I had more than one DNS server in mind, but since I don't I'll just be happy that your remark solved my issue. – nullUser Mar 26 '15 at 23:52
13

There appears to be a bug in the start-up script for dnsmasq that uses resolvconf to clobber the local resolver if the local loopback interface is not explicitly except-ed in the /etc/defaults/dnsmasq file.

The short answer is that you can add...

DNSMASQ_EXCEPT=lo

to /etc/defaults/dnsmasq to solve the problem.

For more info, see this question...

https://raspberrypi.stackexchange.com/questions/37439/proper-way-to-prevent-dnsmasq-from-overwriting-dns-server-list-supplied-by-dhcp

Improve this answer
1
  • 1
    This saved my life. Thank you. – Ryan Bobrowski May 9 '19 at 15:16
5

bigjosh is right - except there's been an update to dnsmasq, and there's now an option at the end of /etc/default/dnsmasq which you can un-hash:

IGNORE_RESOLVCONF=yes
Improve this answer
2
  • This is how it works with my complex setup on Ubuntu 16.04. – Ikon Mar 8 '18 at 12:59
  • 1
    bigjosh's way worked for me. Even though /etc/defaults/dnsmasq had IGNORE_RESOLVECONF=yes with instructions to uncomment it to solve this issue, which it didn't. – andho Jul 23 '18 at 15:01
2

Don't use

resolv-file=/etc/resolv.dnsmasq

Put dns server into dnsmasq.conf, like

server=/localnet/192.168.0.1 # change ip for your ip-server
server=8.8.8.8
server=8.8.4.4

And add into dnsmasq.conf

no-resolv
Improve this answer
1

If you just want a caching-only DNS server and nothing else fancy that dnsmasq can do, you'd be better off installing either lwresd or unbound and using the stock default configuration which gives you a caching-only DNS server. Then you just set /etc/resolv.conf to use "nameserver 127.0.0.1" and you're done.

The nice thing is these two packages do not mess around with what's in /etc/resolv.conf like dnsmasq does and is thus a cleaner solution IMHO. You can also usually remove the resolvconf package so nothing messes around with /etc/resolv.conf.

FYI, dnsmasq has gotten rather complicated, too many bells and whistles and is just causing pain for most people anymore. Violates KISS in my book.

Improve this answer
2
  • Unfortunately, some packages depend on dnsmasq-base, like network-manager and libvirt-bin (if you're doing KVM), so it's not always possible to completely get rid of it. In that case, you can delete /usr/sbin/dnsmaq and make it a hard-link to /bin/true so it always succeeds (to fool the init script) Then chattr +i /usr/sbin/dnsmasq to lock it from being updated. I've had to do this on several laptops. – milli Apr 2 '15 at 23:01
  • +1 as well described in philandstuff.com/2013/11/07/dnsmasq-resolvconf.html . Reallly disgusting behavior and keeps causing pain even 5 years after the post and bug report... – user2480144 Jun 8 '18 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.