Need help to configure internal access

ā„¹ļø Support šŸ“¦ Appliances (Docker, Snappy, VM, NCP, AIO)
6

Split-horizon DNS is a feature, not a separate server. It is a DNS configuration technique used to provide different DNS query results to different sets of clients based on their network location or source IP address. Dnsmasq does support split-horizon DNS configuration.

Thatā€™s what dnsmasq is for, so that the ā€˜hostsā€™ file is configured only for the queries from inside of the network.

Sure:

In my case I have two servers running on Ubuntu in a Network behind a Fritzbox Router.

The Local Network is

192.168.188.0/23

That represents a subnet with an IP address range of 192.168.188.0 to 192.168.189.255

The servers (with- or without) internet access (DMZ) is located In the range 192.168.189.0/24
My private network uses the 192.168.188.0/24 ip-range.

192.168.189.1 - nextcloud, mysql, redis-server, dnsmasq
192.168.189.101 - clamd, dnsmasq, unison-replica of the nextcloud on 192.168.189.1 to create consistant backups

As you see, I use 2 dnsmasq to be more redundant but it works with one as well.

Since ubuntu uses systemd.resolved, I use the following configuration, which is on both servers almost the same. Here the config on 192.168.189.101:

systemd.resolved

man systemd-resolved.service

We have to change the behaviour of systemd.resolved.

edit /etc/systemd/resolved.conf to make it look somhow like this:

# My favorite DNS servers:
DNS=80.80.80.80 9.9.9.9
DNSStubListener=no

Now remove /etc/resolv.conf, which is a symlink to /run/systemd/resolve/stub-resolv.conf and make a static /etc/resolv.conf:

echo "nameserver 127.0.0.1" > /etc/resolv.conf

This is to tell the host system to send its dns-queries to localhost, which now will be served by dnsmasq

dnsmasq

man dnsmasq

config files:

/etc/default/dnsmasq:

ENABLED=1
DNSMASQ_OPTS="--conf-file=/etc/dnsmasq.conf.mine"
CONFIG_DIR=/etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new
IGNORE_RESOLVCONF=yes

/etc/dnsmasq.conf.mine:

domain-needed
bogus-priv
resolv-file = /run/systemd/resolve/resolv.conf
server = /188.168.192.in-addr.arpa/192.168.188.1
listen-address = 127.0.0.1
listen-address = 192.168.189.101
addn-hosts = /etc/dnsmasq.addn-hosts.local

/etc/dnsmasq.addn-hosts.local

192.168.188.1    fritzbox-7580.fritz.box fritzbox.fritz.box fritzbox fritz.box fritzbox-7580 home.box heimat.box
192.168.189.1    alias1 alias2 %MYNEXTCLOUDDOMAIN.TLD%
192.168.189.101  optiplex-380-0.fritz.box optiplex-380-0.fritzbox optiplex-380-0
255.255.255.255  broadcast

As you can see, the file /etc/dnsmasq.addn-hosts.local is now the ā€œhostsā€ file for all queries coming from within the local network. All other queries will be served with the results from the dns servers configured in /etc/systemd/resolved.conf

Now you can do much more with dnsmasq. To redirect all queries from google websites to google dns, which is a bit faster, since it is their realm, add this lines to /etc/dnsmasq.conf.mine:

server = /ytimg.com/8.8.8.8
server = /ytimg.com/8.8.4.4
server = /youtube.com/8.8.8.8
server = /youtube.com/8.8.4.4
server = /googlevideo.com/8.8.8.8
server = /googlevideo.com/8.8.4.4
server = /ggpht.com/8.8.8.8
server = /ggpht.com/8.8.4.4
server = /gvt3.com/8.8.8.8
server = /gvt3.com/8.8.4.4
server = /gvt2.com/8.8.8.8
server = /gvt2.com/8.8.4.4
server = /gvt1.com/8.8.8.8
server = /gvt1.com/8.8.4.4
server = /doubleclick.net/8.8.8.8
server = /doubleclick.net/8.8.4.4
server = /googlesyndication.com/8.8.8.8
server = /googlesyndication.com/8.8.4.4
server = /googleapis.com/8.8.8.8
server = /googleapis.com/8.8.4.4
server = /google.com/8.8.8.8
server = /google.com/8.8.4.4
server = /google.de/8.8.8.8
server = /google.de/8.8.4.4
server = /google.nl/8.8.8.8
server = /google.nl/8.8.4.4
server = /google.ch/8.8.8.8
server = /google.ch/8.8.4.4

You can log all dns-queries dnsmasq makes to tail -f it live. Therefore create a logdir:

mkdir /var/log/dnsmasq
chown dnsmasq.adm /var/log/dnsmasq

apend this lines to /etc/dnsmasq.conf.mine

log-queries
log-facility = /var/log/dnsmasq/dnsmasq.log

In this case, you will have to setup a logrotate rule for that logfile:

/etc/logrotate.d/dnsmasq.log

size 100 M
daily
rotate 2
compress
missingok
notifempty

postrotate
service dnsmasq force-reload
endscript
}

Now you can watch dnsmasq live whyle doing its work:

tail -F /var/log/dnsmasq/dnsmasq.log

I have the same configuration on the server 192.168.189.1, with the only diference is in

/etc/dnsmasq.conf.mine

listen-address = 192.168.189.1

Finaly you have to configure your router to not automatically use the DNS server of the provider, but instead to use the DNS server(s) that you have set up (192.168.189.1 and 192.168.189.101 in my case) as the primary (and eventualy secondary) name servers.

I hope I could help

Even though I have created this post with the greatest possible care, I know with certainty that I (as usual) made at least small mistakes. If you find any inaccuracies please point them out to me, I will correct them immediately if possible or your comment will be the correction.

Happy hacking

1 Like