TTR Networks

Intermediate · DHCP and DNS on the Debian router · section 6 of 6

Build the lab yourself

✓ Lab-tested 5 November 2026 on Debian 13.7, dnsmasq 2.91, dhcpcd 10.1.0, nftables 1.1.3

This lesson continues on the lab from Debian as an office router: build that first, including its Build the lab yourself section, and apply its configuration (networkd, forwarding and nftables) on the router.

  1. Copy office.conf to /etc/dnsmasq.d/ on the router, then dnsmasq --test && systemctl enable --now dnsmasq. dnsmasq is already installed in the lab's router image; on a real Debian machine, apt install dnsmasq first.
  2. Replace /etc/nftables.conf with this lesson's version, which adds the DHCP and DNS rules, and reload it.
  3. On each office host, remove the fixed address from the previous lesson and ask for one by DHCP, for example on the staff PC: ip addr flush dev eth0.10; ip route flush dev eth0.10; dhcpcd -4 -1 -t 30 eth0.10.

The ISP's resolver (198.51.100.53) is started by lab-setup.sh. It answers www.example.com with a TTL of 300 seconds, so the router's cache has something to keep.

Where next

  • Debian as an office router: interfaces, VLANs and a firewallPrerequisite · Intermediate · 45 min

    Turn a fresh Debian 13 install into an office router: systemd-networkd for the WAN and three VLANs on one trunk, IP forwarding, an nftables policy between VLANs with NAT, protecting the router itself, and a configuration that survives a reboot.

  • Office gateway: DHCP, DNS and VRRP on VyOSAlso covers DHCP, DNS · Beginner · 40 min

    Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.

  • PowerDNS on Debian: authoritative, secondary, DNSSEC and recursorAlso covers debian, DNS · Intermediate · 60 min

    Build a complete DNS service on Debian with PowerDNS: authoritative primary and secondary servers with NOTIFY and AXFR, zones by pdnsutil and the HTTP API, DNSSEC signed all the way from a lab root, and a validating recursor for the office.

  • nftables and iptables on Debian: host and router firewallsAlso covers debian · Intermediate · 60 min

    Build a Debian firewall with nftables, from a host firewall to an office router with NAT and port forwards: safe changes with a timed rollback, sets and maps, logging and packet tracing, and what iptables really is on Debian 13.