在EdgeOS/VyOS上启用DNSMASQ

简介

DNSMASQ是英国程序员Simon Kelley开发的一件多功能DHCP服务器/DNS代理工具软件。墙内的IT极客们都非常熟悉它,因为它是逃离DNS污染的必用工具。

我们这里就重点介绍以下DNS转发和地址收集功能。在DNSMASQ配置文件里,你常常可以见到类似以下两行的配置:

server=/creekside.network/1.1.1.1
ipset=/creeksidenet.com/MY_ADDR_GRP

第一项配置,”server=/creekside.network/1.1.1.1″是告诉DNSMASQ,如果遇到以”creekside.network”为后缀的域名,都转发到IP地址是1.1.1.1的DNS服务器上进行解析;

第二项配置,”ipset=/creekside.network/MY_IP_ADDR_GRP“,指示DNSMASQ,把以“creeksidenet.com“为后缀的域名解析结果,都放到名为MY_ADDR_GRP的ipset集合里。

这两项功能对于企业很有用处。比如你在公司内网安装了一个文件服务器,为了方便访问,你可以给它设置一个内部用的域名,比如file.mycompany,在路由器里添加相应的DNSMASQ设置,就可以通过这个域名来访问你内部的资源。

EdgeOS

EdgeOS已经内置了DNSMASQ功能,你可以通过以下配置来启用它。

configure
set service dhcp-server use-dnsmasq enable
set service dns forwarding cache-size 1500
set service dns forwarding name-server 8.8.8.8
set service dns forwarding name-server 8.8.4.4
set service dns forwarding except-interface pppoe0
commit;save;exit

上述配置里,首先启用DNSMASQ(缺省不启用),然后设置DNS缓存大小,以及缺省使用的上游DNS域名服务器。

最后一行是除了pppoe0端口以外,其他端口都启用DNSMASQ。另外与之相斥的配置方法是设置listen-on来指定启用的端口,未指定的端口不启用。比如以下配置就是在eth1和tun0两个端口上启用DNSMASQ。

configure
set service dns forwarding listen-on eth1
set service dns forwarding listen-on tun0
commit;save;exit

另外一个非常好用的配置是options,凡是在options里配置的内容,都会被复制到/etc/dnsmasq.conf文件里。这样我们就可以启用DNSMASQ手册里的所有功能。其典型的配置语法如下:

configure
set service dns forwarding options "conf-file=/config/dnsmasq/dnsmasq-xxxlist-ipset.conf"
commit;save;exit

这个设置指示DNSMASQ从/config/dnsmasq/dnsmasq-xxxlist-ipset.conf装载配置选项。

USG

USG装载的是比较旧版本的EdgeOS,虽然也内置了DNSMASQ功能,但是由于它是用Unifi控制器管理的,有一个限制。系统缺省配置except-interface选项,而且无法删除。这个配置是和listen-on相斥的,如果我们按照官网UniFi – USG Advanced Configuration一文中添加了这一条配置,会造成commit失败,让USG不停地重启。

我们可以配置一条options选项来规避这个问题。

configure
set interfaces loopback lo address 10.255.255.254/32
set service dns forwarding options "listen-address=10.255.255.254"
commit;save;exit

一旦启用这一条,except-interface就失效了。因此在DHCP配置DNS选项时,都把DNS指向10.255.255.254这个地址。

VyOS

不知道VyOS开发团队是如何考虑的,VyOS 1.2版本以后就没有再预装DNSMASQ了,改成PowerDNS,不支持ipset选项。

经过一番摸索,我们找到解决方法,在这里介绍给大家。

从Debian安装DNSMASQ

我们知道,VyOS 1.2.5版本是在Debian Jessie上开发的,理论上我们从Debian官方源安装的软件是可以直接拿来用的。

要从官方源安装软件,需要配置/etc/apt/sources.list文件,不幸的是,VyOS开发团队为了防止我们安装软件,搞乱系统,把soureces.list清空了。不过这难不倒我们。下面的shell命令可以完成DNSMASQ的安装。

echo "deb http://deb.debian.org/debian/ jessie main contrib non-free
deb-src http://deb.debian.org/debian/ jessie main contrib non-free" | sudo tee /etc/apt/sources.list
sudo apt update && sudo apt install dnsmasq -y

好像已经大功告成了,但是事情没有那么简单。如果你重启VyOS,你会发现新安装的DNSMASQ以及相应的缺省配置文件 /etc/dnsmasq.conf 统统不见了。这是因为VyOS开发团队为了保护系统,使用了Overlay文件系统,用户对路由器系统的任何改变都无法永久保存,这样保证了系统的稳健性。

固化DNSMASQ

我们知道,/config目录是会永久保存的,即使系统升级,这个目录也不会被触及。因此,我们可以将dnsmasq程序保存到这个目录里。

sudo mkdir -p /config/dnsmasq/bin
sudo cp /usr/sbin/dnsmasq /config/dnsmasq/bin/

然后,我们可以创建一个基础的配置文件,

echo "log-facility=/var/log/dnsmasq.log
except-interface=eth0
cache-size=15000
server=1.1.1.1	# statically configured
server=8.8.4.4	# statically configured" | sudo tee /config/dnsmasq/dnsmasq.conf

为了在系统重启时自动启动dnsmasq,我们可以修改/config/scripts/vyos-postconfig-bootup.script脚本。

echo "/config/dnsmasq/bin/dnsmasq --conf-file=/config/dnsmasq/dnsmasq.conf" | \
    sudo tee -a /config/scripts/vyos-postconfig-bootup.script

启用DNSMASQ

同理,如果要让终端使用DNSMASQ,而不是系统缺省内置的PowerDNS,我们需要做以下设置。

首先,给loopback接口配置一个IP地址,并在相应的DHCP设置中把DNS指向loopback接口地址。

configure
set interfaces loopback lo address 10.255.255.254/32
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 dns-server 10.255.255.254
commit;save;exit

在dnsmasq配置文件中添加以下设置。

echo "listen-address=10.255.255.254" | sudo tee -a  /config/dnsmasq/dnsmasq.conf

ipset

ipset是防火墙里常用的工具。它可以收集IP地址,用于各种防火墙策略。在EdgeOS/VyOS里,每个address-group实际上就对应相应的ipset集合。

如果你想要在dnsmasq.conf里使用一个MY_ADDR_GRP的ipset,可以在配置里做如下操作。

configure
set firewall group address-group MY_ADDR_GRP
commit;save;exit

终端里常用的ipset命令有:

  • 显示ipset内容,sudo ipset list MY_ADDR_GRP
  • 查找某个IP,sudo ipset test MY_ADDR_GRP 8.8.8.8

在EdgeOS/VyOS上启用DNSMASQ》有223个想法

  1. Kimberley

    Its like you read my mind! You seem to know so much about
    this, like you wrote the book in it or something. I think that you can do with some pics to drive the message home a bit, but other than that, this
    is magnificent blog. A fantastic read. I’ll certainly be back.

    回复
  2. betflix

    Hey I know this is off topic but I was wondering if you knew of any widgets I
    could add to my blog that automatically tweet my newest twitter updates.
    I’ve been looking for a plug-in like this for quite some time and was hoping maybe
    you would have some experience with something like this.
    Please let me know if you run into anything. I truly
    enjoy reading your blog and I look forward to your
    new updates.

    回复
  3. betflix

    Hello there, I discovered your web site via Google
    at the same time as looking for a similar subject, your site got
    here up, it seems to be great. I have bookmarked it in my google bookmarks.

    Hello there, simply was alert to your blog via Google, and located that it’s really informative.
    I’m gonna watch out for brussels. I will appreciate for those who continue
    this in future. Numerous people will likely be benefited out of
    your writing. Cheers!

    回复
  4. lawyer in my area

    I loved as much as you’ll receive carried out right here.
    The sketch is tasteful, your authored subject matter stylish.
    nonetheless, you command get bought an impatience over that
    you wish be delivering the following. unwell unquestionably come more formerly again since exactly the same nearly a lot often inside case you
    shield this increase.

    回复
  5. jasa backlink pbn

    Εxcellent site you havbe here but I was сurioius about if you knew of any forums that covеr the same topics discussed here?
    I’d really like to be a part of community where I can get feedback from otheг exѕperienced іndividuals tһat share the sɑme
    interest. If you have any recommendations, please lett me know.

    Appreсiate іt!

    My site – jasa backlink pbn

    回复
  6. jasa backlink pbn

    Greetіngs! Quick question that’s totally off topic.

    Do you know how too make your sіte mobile friendly?My site looks ԝeird when viewing from my iphone 4.
    I’m trying to find a themne or pluցin that might be able tto fix thiѕ issue.
    If yyou have aany suggeѕtions, please shaгe.

    Tһanks!

    my page – jasa backlink pbn

    回复
  7. solicitor law firm

    You actually make it seem so easy with your presentation but
    I find this matter to be really something that I think I would
    never understand. It seems too complex and
    extremely broad for me. I’m looking forward for your next
    post, I will try to get the hang of it!

    回复
  8. https://mega888-my.com

    My spouse and I absolutely love your blog and find a lot of your post’s to be just what I’m looking for.
    Would you offer guest writers to write content for yourself?

    I wouldn’t mind creating a post or elaborating on many of the subjects you write
    regarding here. Again, awesome blog!

    Feel free to surf to my homepage: joker123 apk new version (https://mega888-my.com)

    回复
  9. serverlist101

    you are really a good webmaster. The web site loading speed
    is incredible. It seems that you’re doingg any unique trick.

    Moreover, The contents are masterwork. you have done a great job on this topic!

    回复
  10. Christi

    I am not sure where you’re getting your information, but
    good topic. I needs to spend some time learning much more or
    understanding more. Thanks for great information I was looking for this info for
    my mission.

    回复
  11. Thorsten

    Greetings! This is my 1st comment here so I just wanted to give a quick
    shout out and tell you I really enjoy reading through your posts.
    Can you recommend any other blogs/websites/forums that deal with the same topics?
    Many thanks!

    回复
  12. Elisabeth

    Hi there, i read your blog occasionally and i own a similar one and i was just wondering if you get a lot of spam comments?
    If so how do you stop it, any plugin or anything you can suggest?

    I get so much lately it’s driving me mad so any help is very much appreciated.

    回复
  13. solicitor article

    Hey just wanted to give you a quick heads up. The words in your article
    seem to be running off the screen in Firefox. I’m not sure if this is a format issue or something to do with internet browser
    compatibility but I thought I’d post to let you know.
    The design look great though! Hope you get the issue solved soon. Kudos

    回复

发表评论

邮箱地址不会被公开。