Custom Dnsmasq DNS, NextDNS

[[email protected]]

Wondering if it's possible to use multiple DNS profiles at NextDNS through custom Dnsmasq settings.

This is the default code provided but I've been trying to edit with no luck in have different vlans/interfaces point to their own profile. Please help in letting me know what needs to be added or removed. Regardless what I've tried this code seem to be global and affects all interfaces.

dnsmasq
Use the following in dnsmasq.conf:

no-resolv
bogus-priv
strict-order
server=2a07:a8c1::
server=45.90.30.0
server=2a07:a8c0::
server=45.90.28.0
add-cpe-id=[B]<profile>[/B]​

Basically what I'm asking is how do you route DNS request based on source interface or subnet.

[jcoehoorn]

I could be wrong here, but IIRC the DHCP settings for each interface/subnet are distinct, and you can put different DNS server assignments there. That is, rather than trying to do advanced selection in the DNS server, you can do so a comparatively simple DNS assignment within each network.

[gravenscroft]

Generally speaking, it's exceptionally rare that someone would need to use custom DNSmasq settings; that's why we have the warning on that page that says 'don't mess around in here'.

I could be wrong here, but IIRC the DHCP settings for each interface/subnet are distinct, and you can put different DNS server assignments there. That is, rather than trying to do advanced selection in the DNS server, you can do so a comparatively simple DNS assignment within each network.

Depends what we're talking about with respect to DNS serving.

When a device gets a DHCP lease from NG Firewall, we give them the interface IP of the interface they're connected to as their DNS server: your computer says 'lease please?' and we respond 'sure, here's your IP address, and also please send DNS queries to my address'. You can set an override in each LAN's DHCP configuration, which changes the DNS server IP we provide as part of the lease. (That's typically useful if you have an internal DNS server.)

When DNS queries are received by NGFW, they're then sent on to whichever DNS server(s) are specified in the WAN config. So your computer says 'please take me to google.com' and NGFW asks the external DNS server for its WAN 'hey, what's the IP for google.com?'

So to jcoehoorn's point: if you have multiple LAN interfaces, each one can be set up to provide a different DNS server as part of a DHCP lease. You might have a 'normal' LAN for computers and another LAN strictly for IoT devices, for example, and you could instruct the normal LAN to send DNS queries to NG Firewall, while the IoT LAN sends DNS queries somewhere else. This may be what you're trying to do? If not, we need some more detail on what your end goal is.

[balrog]

Wondering if it's possible to use multiple DNS profiles at NextDNS through custom Dnsmasq settings.

This is the default code provided but I've been trying to edit with no luck in have different vlans/interfaces point to their own profile. Please help in letting me know what needs to be added or removed. Regardless what I've tried this code seem to be global and affects all interfaces.


Basically what I'm asking is how do you route DNS request based on source interface or subnet.

What you need is Split Horizon or Split DNS. Have done these decades ago on BIND DNS and works well. dnsmasq used by Arista internally has partial support via "-y" or "--localise-queries" and populating /etc/hosts afterwards. You can try, but haven't implemented personally as it's slightly convoluted and no use case for me.