Fedora - Use dnsmasq to provide DNS & DHCP services

Use dnsmasq to provide DNS & DHCP services

<div><p>Many tech enthusiasts find the ability to control their <a href="https://tldp.org/LDP/nag/node35.html">host name resolution important</a>. Setting up servers and services usually requires some form of fixed address, and sometimes also requires special forms of resolution such as defining Kerberos or LDAP servers, mail servers, etc. All of this can be achieved with dnsmasq.</p>
<p>dnsmasq is a lightweight and simple program which enables issuing DHCP addresses on your network and registering the hostname &amp; IP address in DNS. This configuration also allows external resolution, so your whole network will be able to speak to itself and find external sites too.</p>
<p> <span id="more-31893"></span> </p>
<p>This article covers installing and configuring dnsmasq on either a virtual machine or small physical machine like a Raspberry Pi so it can provide these services in your home network or lab. If you have an existing setup and just need to adjust the settings for your local workstation, read the previous article which covers <a href="https://fedoramagazine.org/using-the-networkmanagers-dnsmasq-plugin/">configuring the dnsmasq plugin in NetworkManager.</a></p>
<h2><strong>Install dnsmasq</strong></h2>
<p>First, install the dnsmasq package:</p>
<pre class="wp-block-preformatted">sudo dnf install dnsmasq</pre>
<p>Next, enable and start the dnsmasq service:</p>
<pre class="wp-block-preformatted">sudo systemctl enable --now dnsmasq</pre>
<h2>Configure dnsmasq</h2>
<p>First, make a backup copy of the <em>dnsmasq.conf</em> file:</p>
<pre class="wp-block-preformatted">sudo cp /etc/dnsmasq.conf /etc/dnsmasq.conf.orig</pre>
<p>Next, edit the file and make changes to the following to reflect your network. In this example, mydomain.org is the domain name, 192.168.1.10 is the IP address of the dnsmasq server and 192.168.1.1 is the default gateway.</p>
<pre class="wp-block-preformatted">sudo vi /etc/dnsmasq.conf</pre>
<p>Insert the following contents:</p>
<pre class="wp-block-preformatted">domain-needed
bogus-priv
no-resolv
server=8.8.8.8
server=8.8.4.4
local=/mydomain.org/
listen-address=::1,127.0.0.1,192.168.1.10
expand-hosts
domain=mydomain.org
dhcp-range=192.168.1.100,192.168.1.200,24h
dhcp-option=option:router,192.168.1.1
dhcp-authoritative
dhcp-leasefile=/var/lib/dnsmasq/dnsmasq.leases</pre>
<p>Test the config to check for typos and syntax errors:</p>
<pre class="wp-block-preformatted">$ <strong>sudo dnsmasq --test</strong>
dnsmasq: syntax check OK.</pre>
<p>Now edit the <em>hosts</em> file, which can contain both statically- and dynamically-allocated hosts. Static addresses should lie outside the DHCP range you specified earlier. Hosts using DHCP but which need a fixed address should be entered here with an address within the DHCP range.</p>
<pre class="wp-block-preformatted">sudo vi /etc/hosts</pre>
<p>The first two lines should be there already. Add the remaining lines to configure the router, the dnsmasq server, and two additional servers.</p>
<pre class="wp-block-preformatted wp-block-syntaxhighlighter-code">127.0.0.1 &nbsp; localhost localhost.localdomain
::1 &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; localhost localhost.localdomain
192.168.1.1&nbsp; &nbsp; router
192.168.1.10 &nbsp; dnsmasq
192.168.1.20 &nbsp; server1
192.168.1.30 &nbsp; server2</pre>
<p>Restart the dnsmasq service:</p>
<pre class="wp-block-preformatted">sudo systemctl restart dnsmasq</pre>
<p>Next add the services to the firewall to allow the clients to connect:</p>
<pre class="wp-block-preformatted">sudo firewall-cmd --add-service={dns,dhcp}<br />sudo firewall-cmd --runtime-to-permanent</pre>
<h2>Test name resolution</h2>
<p>First, install <em>bind-utils</em> to get the <em>nslookup</em> and <em>dig</em> packages. These allow you to perform both forward and reverse lookups. You could use ping if you’d rather not install extra packages. but these tools are worth installing for the additional troubleshooting functionality they can provide.</p>
<pre class="wp-block-preformatted">sudo dnf install bind-utils</pre>
<p>Now test the resolution. First, test the forward (hostname to IP address) resolution:</p>
<pre class="wp-block-preformatted">$ <strong>nslookup server1</strong>
Server: &nbsp; &nbsp;&nbsp;&nbsp; 127.0.0.1
Address:&nbsp; &nbsp; 127.0.0.1#53
Name:&nbsp; &nbsp; server1.mydomain.org
Address: 192.168.1.20</pre>
<p>Next, test the reverse (IP address to hostname) resolution:</p>
<pre class="wp-block-preformatted">$ <strong>nslookup 192.168.1.20</strong>
20.1.168.192.in-addr.arpa&nbsp; &nbsp; name = server1.mydomain.org.</pre>
<p>Finally, test resolving hostnames outside of your network:</p>
<pre class="wp-block-preformatted">$ <strong>nslookup fedoramagazine.org</strong>
Server: &nbsp; &nbsp;&nbsp;&nbsp; 127.0.0.1
Address:&nbsp; &nbsp; 127.0.0.1#53
Non-authoritative answer:
Name:&nbsp; &nbsp; fedoramagazine.org
Address: 35.196.109.67</pre>
<h2><strong>Test DHCP leases</strong></h2>
<p>To test DHCP leases, you need to boot a machine which uses DHCP to obtain an IP address. Any Fedora variant will do that by default. Once you have booted the client machine, check that it has an address and that it corresponds to the lease file for dnsmasq.</p>
<p>From the machine running dnsmasq:</p>
<pre class="wp-block-preformatted">$ <strong>sudo cat /var/lib/dnsmasq/dnsmasq.leases</strong>
1598023942 52:54:00:8e:d5:db <strong>192.168.1.100 server3</strong> 01:52:54:00:8e:d5:db
1598019169 52:54:00:9c:5a:bb <strong>192.168.1.101 server4</strong> 01:52:54:00:9c:5a:bb</pre>
<h2><strong>Extending functionality</strong></h2>
<p>You can assign hosts a fixed IP address via DHCP by adding it to your hosts file with the address you want (within your DHCP range). Do this by adding into the <em>dnsmasq.conf</em> file the following line, which assigns the IP listed to any host that has that name:</p>
<pre class="wp-block-preformatted">dhcp-host=myhost</pre>
<p>Alternatively, you can specify a MAC address which should always be given a fixed IP address:</p>
<pre class="wp-block-preformatted">dhcp-host=11:22:33:44:55:66,192.168.1.123</pre>
<p>You can specify a PXE boot server if you need to automate machine builds</p>
<pre class="wp-block-preformatted">tftp-root=/tftpboot<br />dhcp-boot=/tftpboot/pxelinux.0,boothost,192.168.1.240</pre>
<p>This should point to the actual URL of your TFTP server.</p>
<p>If you need to specify SRV or TXT records, for example for LDAP, Kerberos or similar, you can add these:</p>
<pre class="wp-block-preformatted">srv-host=_ldap._tcp.mydomain.org,ldap-server.mydomain.org,389<br />srv-host=_kerberos._udp.mydomain.org,krb-server.mydomain.org,88<br />srv-host=_kerberos._tcp.mydomain.org,krb-server.mydomain.org,88<br />srv-host=_kerberos-master._udp.mydomain.org,krb-server.mydomain.org,88<br />srv-host=_kerberos-adm._tcp.mydomain.org,krb-server.mydomain.org,749<br />srv-host=_kpasswd._udp.mydomain.org,krb-server.mydomain.org,464<br />txt-record=_kerberos.mydomain.org,KRB-SERVER.MYDOMAIN.ORG</pre>
<p>There are many other options in dnsmasq. The comments in the original config file describe most of them. For full details, read the man page, either locally or <a href="http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html">online</a>.</p>
</div>


https://www.sickgaming.net/blog/2020/09/...-services/