One daemon for DHCP and DNS
Add DHCP and DNS to a Debian router with dnsmasq: a range and lease time per VLAN, a reservation, local names from DHCP, a caching forwarder, blocking a domain, the firewall rules it needs, and reading its log when a VLAN gets no address.
By the end you will be able to:
- Configure dnsmasq to serve DHCP and DNS on a router's VLANs, and never on the WAN
- Give each VLAN its own address range and lease time, and reserve an address for a server
- Serve local names from DHCP leases, and forward and cache everything else
- Allow DHCP and DNS in the router's input chain, and recognise what a blocked client looks like
- Diagnose a VLAN that gets no address from dnsmasq's log
Prerequisites: Debian as an office router: interfaces, VLANs and a firewall
The router from Debian as an office router routes three VLANs, but every machine on them still needs an address, a gateway and a DNS server typed in by hand. On a small network, one program does all of that: dnsmasq, a DHCP server and caching DNS forwarder in a single small daemon, packaged in Debian and used inside countless home routers.
This lesson adds it to the same router:
- DHCP on each VLAN: a range of addresses, a lease time, and the gateway and DNS server to use, with guests on shorter leases.
- Reservations, so a server always gets the same address.
- DNS: the router answers the office's queries, forwards the rest to the ISP's resolver and caches the answers.
- Local names, so
fileserver.office.lanworks without anyone maintaining a zone. - Blocking a domain for the whole office.
- The firewall rules that let all of this reach the router.
The lab
The same lab as the previous lesson: the router with its staff, guest and servers VLANs on one trunk, and the ISP. The ISP now also runs a resolver at 198.51.100.53, standing in for the internet's DNS, which knows www.example.com. The office hosts drop their fixed addresses and ask for one by DHCP with dhcpcd, Debian 13's DHCP client.
- Asking for an address. The staff PC broadcasts a DHCP request on VLAN 10. The router's input chain must allow UDP 67, or dnsmasq never sees it.
- An address, a gateway and a resolver. dnsmasq picks the range that matches the VLAN, and answers with 10.10.10.178 for 12 hours, the router as gateway and DNS server, and the office.lan domain.
- Local names. fileserver.office.lan comes from the reservation; staff.office.lan and guest.office.lan from the names the clients sent. The router answers them itself.
- Everything else: forward and cache. www.example.com goes to the ISP's resolver once; the router caches the answer for its TTL and answers every later query itself.