3 dnsmasq \- A lightweight DHCP and caching DNS server.
9 is a lightweight DNS and DHCP server. It is intended to provide coupled DNS and DHCP service to a
12 Dnsmasq accepts DNS queries and either answers them from a small, local,
13 cache or forwards them to a real, recursive, DNS server. It loads the
14 contents of /etc/hosts so that local hostnames
15 which do not appear in the global DNS can be resolved and also answers
16 DNS queries for DHCP configured hosts.
18 The dnsmasq DHCP server supports static address assignments, multiple
19 networks, DHCP-relay and RFC3011 subnet specifiers. It automatically
20 sends a sensible default set of DHCP options, and can be configured to
21 send any desired set of DHCP options. It also supports BOOTP.
26 Note that in general missing parameters are allowed and switch off
27 functions, for instance "--pid-file=" disables writing a PID file. On
28 BSD, unless the GNU getopt library is linked, the long form of the
29 options does not work on the command line; it is still recognised in
30 the configuration file.
33 Don't read the hostnames in /etc/hosts.
35 .B \-H, --addn-hosts=<file>
36 Additional hosts file. Read the specified file as well as /etc/hosts. If -h is given, read
37 only the specified file. This option may be repeated for more than one
38 additional hosts file.
40 .B \-T, --local-ttl=<time>
41 When replying with information from /etc/hosts or the DHCP leases
42 file dnsmasq by default sets the time-to-live field to zero, meaning
43 that the requestor should not itself cache the information. This is
44 the correct thing to do in almost all situations. This option allows a
45 time-to-live (in seconds) to be given for these replies. This will
46 reduce the load on the server at the expense of clients using stale
47 data under some circumstances.
49 .B \-k, --keep-in-foreground
50 Do not go into the background at startup but otherwise run as
51 normal. This is intended for use when dnsmasq is run under daemontools
55 Debug mode: don't fork to the background, don't write a pid file,
56 don't change user id, generate a complete cache dump on receipt on
57 SIGUSR1, log to stderr as well as syslog, don't fork new processes
58 to handle TCP queries.
61 Log the results of DNS queries handled by dnsmasq. Enable a full cache dump on receipt of SIGUSR1.
63 .B \-x, --pid-file=<path>
64 Specify an alternate path for dnsmasq to record its process-id in. Normally /var/run/dnsmasq.pid.
66 .B \-u, --user=<username>
67 Specify the userid to which dnsmasq will change after startup. Dnsmasq must normally be started as root, but it will drop root
68 privileges after startup by changing id to another user. Normally this user is "nobody" but that
69 can be over-ridden with this switch.
71 .B \-g, --group=<groupname>
72 Specify the group which dnsmasq will run
73 as. The defaults to "dip", if available, to facilitate access to
74 /etc/ppp/resolv.conf which is not normally world readable.
77 Print the version number.
80 Listen on <port> instead of the standard DNS port (53). Useful mainly for
83 .B \-P, --edns-packet-max=<size>
84 Specify the largest EDNS.0 UDP packet which is supported by the DNS
85 forwarder. Defaults to 1280, which is the RFC2671-recommended maximum
88 .B \-Q, --query-port=<query_port>
89 Send outbound DNS queries from, and listen for their replies on, the specific UDP port <query_port> instead of using one chosen at runtime. Useful to simplify your
90 firewall rules; without this, your firewall would have to allow connections from outside DNS servers to a range of UDP ports, or dynamically adapt to the
91 port being used by the current dnsmasq instance.
93 .B \-i, --interface=<interface name>
94 Listen only on the specified interface(s). Dnsmasq automatically adds
95 the loopback (local) interface to the list of interfaces to use when
102 options are given dnsmasq listens on all available interfaces except any
104 .B \--except-interface
105 options. IP alias interfaces (eg "eth1:0") cannot be used with
108 .B --except-interface
109 options, use --listen-address instead.
111 .B \-I, --except-interface=<interface name>
112 Do not listen on the specified interface. Note that the order of
116 .B --except-interface
117 options does not matter and that
118 .B --except-interface
119 options always override the others.
121 .B \-2, --no-dhcp-interface=<interface name>
122 Do not provide DHCP on the specified interface, but do provide DNS service.
124 .B \-a, --listen-address=<ipaddr>
125 Listen on the given IP address(es). Both
129 options may be given, in which case the set of both interfaces and
130 addresses is used. Note that if no
134 is, dnsmasq will not automatically listen on the loopback
135 interface. To achieve this, its IP address, 127.0.0.1, must be
136 explicitly given as a
140 .B \-z, --bind-interfaces
141 On systems which support it, dnsmasq binds the wildcard address,
142 even when it is listening on only some interfaces. It then discards
143 requests that it shouldn't reply to. This has the advantage of
144 working even when interfaces come and go and change address. This
145 option forces dnsmasq to really bind only the interfaces it is
146 listening on. About the only time when this is useful is when
147 running another nameserver (or another instance of dnsmasq) on the
148 same machine. Setting this option also enables multiple instances of
149 dnsmasq which provide DHCP service to run in the same machine.
151 .B \-y, --localise-queries
152 Return answers to DNS queries from /etc/hosts which depend on the interface over which the query was
153 received. If a name in /etc/hosts has more than one address associated with
154 it, and at least one of those addresses is on the same subnet as the
155 interface to which the query was sent, then return only the
156 address(es) on that subnet. This allows for a server to have multiple
157 addresses in /etc/hosts corresponding to each of its interfaces, and
158 hosts will get the correct address based on which network they are
159 attached to. Currently this facility is limited to IPv4.
162 Bogus private reverse lookups. All reverse lookups for private IP ranges (ie 192.168.x.x, etc)
163 which are not found in /etc/hosts or the DHCP leases file are answered
164 with "no such domain" rather than being forwarded upstream.
166 .B \-V, --alias=<old-ip>,<new-ip>[,<mask>]
167 Modify IPv4 addresses returned from upstream nameservers; old-ip is
168 replaced by new-ip. If the optional mask is given then any address
169 which matches the masked old-ip will be re-written. So, for instance
170 .B --alias=1.2.3.0,6.7.8.0,255.255.255.0
171 will map 1.2.3.56 to 6.7.8.56 and 1.2.3.67 to 6.7.8.67. This is what
172 Cisco PIX routers call "DNS doctoring".
174 .B \-B, --bogus-nxdomain=<ipaddr>
175 Transform replies which contain the IP address given into "No such
176 domain" replies. This is intended to counteract a devious move made by
177 Verisign in September 2003 when they started returning the address of
178 an advertising web page in response to queries for unregistered names,
179 instead of the correct NXDOMAIN response. This option tells dnsmasq to
180 fake the correct response when it sees this behaviour. As at Sept 2003
181 the IP address being returned by Verisign is 64.94.110.11
183 .B \-f, --filterwin2k
184 Later versions of windows make periodic DNS requests which don't get sensible answers from
185 the public DNS and can cause problems by triggering dial-on-demand links. This flag turns on an option
186 to filter such requests. The requests blocked are for records of types SOA and SRV, and type ANY where the
187 requested name has underscores, to catch LDAP requests.
189 .B \-r, --resolv-file=<file>
190 Read the IP addresses of the upstream nameservers from <file>, instead of
191 /etc/resolv.conf. For the format of this file see
193 the only lines relevant to dnsmasq are nameserver ones. Dnsmasq can
194 be told to poll more than one resolv.conf file, the first file name specified
195 overrides the default, subsequent ones add to the list. This is only
196 allowed when polling; the file with the currently latest modification
197 time is the one used.
200 Don't read /etc/resolv.conf. Get upstream servers only from the command
201 line or the dnsmasq configuration file.
203 .B \-1, --enable-dbus
204 Allow dnsmasq configuration to be updated via DBus method calls. The
205 configuration which can be changed is upstream DNS servers (and
206 corresponding domains) and cache clear. Requires that dnsmasq has
207 been built with DBus support.
209 .B \-o, --strict-order
210 By default, dnsmasq will send queries to any of the upstream servers
211 it knows about and tries to favour servers to are known to
212 be up. Setting this flag forces dnsmasq to try each query with each
213 server strictly in the order they appear in /etc/resolv.conf
216 Don't poll /etc/resolv.conf for changes.
218 .B \-D, --domain-needed
219 Tells dnsmasq to never forward queries for plain names, without dots
220 or domain parts, to upstream nameservers. If the name is not known
221 from /etc/hosts or DHCP then a "not found" answer is returned.
223 .B \-S, --server=[/[<domain>]/[domain/]][<ipaddr>[#<port>][@<source>[#<port>]]]
224 Specify IP address of upstream severs directly. Setting this flag does
225 not suppress reading of /etc/resolv.conf, use -R to do that. If one or
227 optional domains are given, that server is used only for those domains
228 and they are queried only using the specified server. This is
229 intended for private nameservers: if you have a nameserver on your
230 network which deals with names of the form
231 xxx.internal.thekelleys.org.uk at 192.168.1.1 then giving the flag
232 .B -S /internal.thekelleys.org.uk/192.168.1.1
233 will send all queries for
234 internal machines to that nameserver, everything else will go to the
235 servers in /etc/resolv.conf. An empty domain specification,
237 has the special meaning of "unqualified names only" ie names without any
238 dots in them. A non-standard port may be specified as
240 address using a # character.
241 More than one -S flag is allowed, with
242 repeated domain or ipaddr parts as required.
244 Also permitted is a -S
245 flag which gives a domain but no IP address; this tells dnsmasq that
246 a domain is local and it may answer queries from /etc/hosts or DHCP
247 but should never forward queries on that domain to any upstream
252 to make configuration files clearer in this case.
254 The optional second IP address after the @ character tells
255 dnsmasq how to set the source address of the queries to this
256 nameserver. It should be an address belonging to the machine on which
257 dnsmasq is running otherwise this server line will be logged and then
258 ignored. The query-port flag is ignored for any servers which have a
259 source address specified but the port may be specified directly as
260 part of the source address.
262 .B \-A, --address=/<domain>/[domain/]<ipaddr>
263 Specify an IP address to return for any host in the given domains.
264 Queries in the domains are never forwarded and always replied to
265 with the specified IP address which may be IPv4 or IPv6. To give
266 both IPv4 and IPv6 addresses for a domain, use repeated -A flags.
267 Note that /etc/hosts and DHCP leases override this for individual
268 names. A common use of this is to redirect the entire doubleclick.net
269 domain to some friendly local web server to avoid banner ads. The
270 domain specification works in the same was as for --server, with the
271 additional facility that /#/ matches any domain. Thus
272 --address=/#/1.2.3.4 will always return 1.2.3.4 for any query not
273 answered from /etc/hosts or DHCP and not sent to an upstream
274 nameserver by a more specific --server directive.
276 .B \-m, --mx-host=<mx name>[[,<hostname>],<preference>]
277 Return an MX record named <mx name> pointing to the given hostname (if
279 the host specified in the --mx-target switch
280 or, if that switch is not given, the host on which dnsmasq
281 is running. The default is useful for directing mail from systems on a LAN
282 to a central server. The preference value is optional, and defaults to
283 1 if not given. More than one MX record may be given for a host.
285 .B \-t, --mx-target=<hostname>
286 Specify the default target for the MX record returned by dnsmasq. See
287 --mx-host. If --mx-target is given, but not --mx-host, then dnsmasq
288 returns a MX record containing the MX target for MX queries on the
289 hostname of the machine on which dnsmasq is running.
292 Return an MX record pointing to itself for each local
293 machine. Local machines are those in /etc/hosts or with DHCP leases.
296 Return an MX record pointing to the host given by mx-target (or the
297 machine on which dnsmasq is running) for each
298 local machine. Local machines are those in /etc/hosts or with DHCP
301 .B \-W, --srv-host=<_service>.<_prot>.[<domain>],[<target>[,<port>[,<priority>[,<weight>]]]]
302 Return a SRV DNS record. See RFC2782 for details. If not supplied, the
303 domain defaults to that given by
305 The default for the target domain is empty, and the default for port
306 is one and the defaults for
307 weight and priority are zero. Be careful if transposing data from BIND
308 zone files: the port, weight and priority numbers are in a different
309 order. More than one SRV record for a given service/domain is allowed,
310 all that match are returned.
312 .B \-Y, --txt-record=<name>[[,<text>],<text>]
313 Return a TXT DNS record. The value of TXT record is a set of strings,
314 so any number may be included, split by commas.
316 .B \-c, --cache-size=<cachesize>
317 Set the size of dnsmasq's cache. The default is 150 names. Setting the cache size to zero disables caching.
319 .B \-N, --no-negcache
320 Disable negative caching. Negative caching allows dnsmasq to remember
321 "no such domain" answers from upstream nameservers and answer
322 identical queries without forwarding them again. This flag disables
325 .B \-F, --dhcp-range=[[net:]network-id,]<start-addr>,<end-addr>[[,<netmask>],<broadcast>][,<default lease time>]
326 Enable the DHCP server. Addresses will be given out from the range
327 <start-addr> to <end-addr> and from statically defined addresses given
330 options. If the lease time is given, then leases
331 will be given for that length of time. The lease time is in seconds,
332 or minutes (eg 45m) or hours (eg 1h) or the literal "infinite". This
333 option may be repeated, with different addresses, to enable DHCP
334 service to more than one network. For directly connected networks (ie,
335 networks on which the machine running dnsmasq has an interface) the
336 netmask is optional. It is, however, required for networks which
337 receive DHCP service via a relay agent. The broadcast address is
338 always optional. On some broken systems, dnsmasq can listen on only
339 one interface when using DHCP, and the name of that interface must be
342 option. This limitation currently affects OpenBSD. It is always
343 allowed to have more than one dhcp-range in a single subnet. The optional
344 network-id is a alphanumeric label which marks this network so that
345 dhcp options may be specified on a per-network basis.
346 When it is prefixed with 'net:' then its meaning changes from setting
347 a tag to matching it. Only one tag may be set, but more than one tag may be matched.
348 The end address may be replaced by the keyword
350 which tells dnsmasq to enable DHCP for the network specified, but not
351 to dynamically allocate IP addresses. Only hosts which have static
354 or from /etc/ethers will be served.
356 .B \-G, --dhcp-host=[[<hwaddr>]|[id:[<client_id>][*]]][net:<netid>][,<ipaddr>][,<hostname>][,<lease_time>][,ignore]
357 Specify per host parameters for the DHCP server. This allows a machine
358 with a particular hardware address to be always allocated the same
359 hostname, IP address and lease time. A hostname specified like this
360 overrides any supplied by the DHCP client on the machine. It is also
361 allowable to ommit the hardware address and include the hostname, in
362 which case the IP address and lease times will apply to any machine
363 claiming that name. For example
364 .B --dhcp-host=00:20:e0:3b:13:af,wap,infinite
365 tells dnsmasq to give
366 the machine with hardware address 00:20:e0:3b:13:af the name wap, and
367 an infinite DHCP lease.
368 .B --dhcp-host=lap,192.168.0.199
370 dnsmasq to always allocate the machine lap the IP address
371 192.168.0.199. Addresses allocated like this are not constrained to be
372 in the range given by the --dhcp-range option, but they must be on the
373 network being served by the DHCP server. It is allowed to use client identifiers rather than
374 hardware addresses to identify hosts by prefixing with 'id:'. Thus:
375 .B --dhcp-host=id:01:02:03:04,.....
376 refers to the host with client identifier 01:02:03:04. It is also
377 allowed to specify the client ID as text, like this:
378 .B --dhcp-host=id:clientidastext,.....
379 The special option id:* means "ignore any client-id
380 and use MAC addresses only." This is useful when a client presents a client-id sometimes
382 If a name appears in /etc/hosts, the associated address can be
383 allocated to a DHCP lease, but only if a
385 option specifying the name also exists. The special keyword "ignore"
386 tells dnsmasq to never offer a DHCP lease to a machine. The machine
387 can be specified by hardware address, client ID or hostname, for
389 .B --dhcp-host=00:20:e0:3b:13:af,ignore
391 useful when there is another DHCP server on the network which should
392 be used by some machines. The net:<network-id> sets the network-id tag
393 whenever this dhcp-host directive is in use.
394 This can be used to selectively send DHCP options just
396 Ethernet addresses (but not client-ids) may have
397 wildcard bytes, so for example
398 .B --dhcp-host=00:20:e0:3b:13:*,ignore
399 will cause dnsmasq to ignore a range of hardware addresses. Note that
400 the "*" will need to be escaped or quoted on a command line, but not
401 in the configuration file. Hardware addresses normally match any
402 network (ARP) type, but it is possible to restrict them to a single
403 ARP type by preceding them with the ARP-type (in HEX) and "-". so
404 .B --dhcp-host=06-00:20:e0:3b:13:af,1.2.3.4
406 Token-Ring hardware address, since the ARP-address type for token ring
409 .B \-Z, --read-ethers
410 Read /etc/ethers for information about hosts for the DHCP server. The
411 format of /etc/ethers is a hardware address, followed by either a
412 hostname or dotted-quad IP address. When read by dnsmasq these lines
413 have exactly the same effect as
415 options containing the same information.
417 .B \-O, --dhcp-option=[<network-id>,[<network-id>,]][vendor:<vendor-class>]<opt>,[<value>[,<value>]]
418 Specify different or extra options to DHCP clients. By default,
419 dnsmasq sends some standard options to DHCP clients, the netmask and
420 broadcast address are set to the same as the host running dnsmasq, and
421 the DNS server and default route are set to the address of the machine
422 running dnsmasq. If the domain name option has been set, that is sent.
423 This option allows these defaults to be overridden,
424 or other options specified. The <opt> is the number of the option, as
425 specified in RFC2132. For example, to set the default route option to
427 .B --dhcp-option=3,192.168.4.4
428 and to set the time-server address to 192.168.0.4, do
429 .B --dhcp-option=42,192.168.0.4
430 The special address 0.0.0.0 is taken to mean "the address of the
431 machine running dnsmasq". Data types allowed are comma separated
432 dotted-quad IP addresses, a decimal number, colon-separated hex digits
433 and a text string. If the optional network-ids are given then
434 this option is only sent when all the network-ids are matched.
436 Special processing is done on a text argument for option 119, to
437 conform with RFC 3397, and dotted-quad IP addresses which are followed
438 by a slash and then a netmask size are encoded as described in RFC
441 Be careful: no checking is done that the correct type of data for the
442 option number is sent, it is quite possible to
443 persuade dnsmasq to generate illegal DHCP packets with injudicious use
444 of this flag. When the value is a decimal number, dnsmasq must determine how
445 large the data item is. It does this by examining the option number and/or the
446 value, but can be overridden by appending a single letter flag as follows:
447 b = one byte, s = two bytes, i = four bytes. This is mainly useful with
448 encapsulated vendor class options (see below) where dnsmasq cannot
449 determine data size from the option number. Option data which
450 consists solely of periods and digits will be interpreted by dnsmasq
451 as an IP address, and inserted into an option as such. To force a
452 literal string, use quotes. For instance when using option 66 to send
453 a literal IP address as TFTP server name, it is necessary to do
454 .B --dhcp-option=66,"1.2.3.4"
456 Encapsulated Vendor-class options may also be specified using
457 --dhcp-option: for instance
458 .B --dhcp-option=vendor:PXEClient,1,0.0.0.0
459 sends the vendor class "PXEClient" and the encapsulated vendor class-specific option "mftp-address=0.0.0.0" Only one vendor class is allowed for any
460 host, but multiple options are allowed, provided they all have
461 the same vendor class. The address 0.0.0.0 is not treated specially in
462 encapsulated vendor class options.
464 .B \-U, --dhcp-vendorclass=<network-id>,<vendor-class>
465 Map from a vendor-class string to a network id. Most DHCP clients provide a
466 "vendor class" which represents, in some sense, the type of host. This option
467 maps vendor classes to network ids, so that DHCP options may be selectively delivered
468 to different classes of hosts. For example
469 .B dhcp-vendorclass=printers,Hewlett-Packard JetDirect
470 will allow options to be set only for HP printers like so:
471 .B --dhcp-option=printers,3,192.168.4.4
472 The vendor-class string is
473 substring matched against the vendor-class supplied by the client, to
474 allow fuzzy matching.
476 .B \-j, --dhcp-userclass=<network-id>,<user-class>
477 Map from a user-class string to a network id (with substring
478 matching, like vendor classes). Most DHCP clients provide a
479 "user class" which is configurable. This option
480 maps user classes to network ids, so that DHCP options may be selectively delivered
481 to different classes of hosts. It is possible, for instance to use
482 this to set a different printer server for hosts in the class
483 "accounts" than for hosts in the class "engineering".
485 .B \-4, --dhcp-mac=<network-id>,<MAC address>
486 Map from a MAC address to a network-id. The MAC address may include
487 wildcards. For example
488 .B --dhcp-mac=3com,01:34:23:*:*:*
489 will set the tag "3com" for any host whose MAC address matches the pattern.
491 .B \-J, --dhcp-ignore=<network-id>[,<network-id>]
492 When all the given network-ids match the set of network-ids derived
493 from the net, host, vendor and user classes, ignore the host and do
494 not allocate it a DHCP lease.
496 .B \-M, --dhcp-boot=[net:<network-id>,]<filename>,[<servername>[,<server address>]]
497 Set BOOTP options to be returned by the DHCP server. These are needed
498 for machines which network boot, and tell the machine where to collect
499 its initial configuration. If the optional network-id(s) are given,
500 they must match for this configuration to be sent. Note that
501 network-ids are prefixed by "net:" to distinguish them.
503 .B \-X, --dhcp-lease-max=<number>
504 Limits dnsmasq to the specified maximum number of DHCP leases. The
505 default is 150. This limit is to prevent DoS attacks from hosts which
506 create thousands of leases and use lots of memory in the dnsmasq
509 .B \-K, --dhcp-authoritative
510 Should be set when dnsmasq is definately the only DHCP server on a network.
511 It changes the behaviour from strict RFC compliance so that DHCP requests on
512 unknown leases from unknown hosts are not ignored. This allows new hosts
513 to get a lease without a tedious timeout under all circumstances. It also
514 allows dnsmasq to rebuild its lease database without each client needing to
515 reaquire a lease, if the database is lost.
517 .B \-3, --bootp-dynamic
518 Enable dynamic allocation of IP addresses to BOOTP clients. Use this
519 with care, since each address allocated to a BOOTP client is leased
520 forever, and therefore becomes permanently unavailable for re-use by
524 By default, the DHCP server will attempt to ensure that an address in
525 not in use before allocating it to a host. It does this by sending an
526 ICMP echo request (aka "ping") to the address in question. If it gets
527 a reply, then the address must already be in use, and another is
528 tried. This flag disables this check. Use with caution.
530 .B \-l, --dhcp-leasefile=<path>
531 Use the specified file to store DHCP lease information. If this option
532 is given but no dhcp-range option is given then dnsmasq version 1
533 behaviour is activated. The file given is assumed to be an ISC dhcpd
534 lease file and parsed for leases which are then added to the DNS
535 system if they have a hostname. This functionality may have been
536 excluded from dnsmasq at compile time, in which case an error will occur.
538 .B \-s, --domain=<domain>
539 Specifies the domain for the DHCP server. This has two effects;
540 firstly it causes the DHCP server to return the domain to any hosts
541 which request it, and secondly it sets the domain which it is legal
542 for DHCP-configured hosts to claim. The intention is to constrain hostnames so that an untrusted host on the LAN cannot advertise it's name via dhcp as e.g. "microsoft.com" and capture traffic not meant for it. If no domain suffix is specified, then any DHCP hostname with a domain part (ie with a period) will be disallowed and logged. If suffix is specified, then hostnames with a domain part are allowed, provided the domain part matches the suffix. In addition, when a suffix is set then hostnames without a domain part have the suffix added as an optional domain part. Eg on my network I can set
543 .B --domain=thekelleys.org.uk
544 and have a machine whose DHCP hostname is "laptop". The IP address for that machine is available from
546 both as "laptop" and "laptop.thekelleys.org.uk". If the domain is
547 given as "#" then the domain is read from the first "search" directive
548 in /etc/resolv.conf (or equivalent).
550 .B \-E, --expand-hosts
551 Add the domain to simple names (without a period) in /etc/hosts
552 in the same way as for DHCP-derived names.
554 .B \-C, --conf-file=<file>
555 Specify a different configuration file. The conf-file option is also allowed in
556 configuration files, to include multiple configuration files. Only one
557 level of nesting is allowed.
559 At startup, dnsmasq reads
560 .I /etc/dnsmasq.conf,
563 .I /usr/local/etc/dnsmasq.conf
566 option.) The format of this
567 file consists of one option per line, exactly as the long options detailed
568 in the OPTIONS section but without the leading "--". Lines starting with # are comments and ignored. For
569 options which may only be specified once, the configuration file overrides
570 the command line. Quoting is allowed in a config file:
571 between " quotes the special meanings of ,:. and # are removed and the
572 following escapes are allowed: \\\\ \\" \\t \\a \\b \\r and \\n. The later
573 corresponding to tab, bell, backspace, return and newline.
575 When it receives a SIGHUP,
577 clears its cache and then re-loads
582 is set SIGHUP also re-reads
585 does NOT re-read the configuration file.
587 When it receives a SIGUSR1,
589 writes cache statistics to the system log. It writes the cache size,
590 the number of names which have had to removed from the cache before
591 they expired in order to make room for new names and the total number
592 of names that have been inserted into the cache. In
594 mode or when full logging is enabled (-q), a complete dump of the contents of the cache is made.
596 Dnsmasq is a DNS query forwarder: it it not capable of recursively
597 answering arbitrary queries starting from the root servers but
598 forwards such queries to a fully recursive upstream DNS server which is
599 typically provided by an ISP. By default, dnsmasq reads
602 addresses of the upstream nameservers it should use, since the
603 information is typically stored there. Unless
607 checks the modification time of
611 is used) and re-reads it if it changes. This allows the DNS servers to
612 be set dynamically by PPP or DHCP since both protocols provide the
617 since it may not have been created before a PPP connection exists. Dnsmasq
618 simply keeps checking in case
621 time. Dnsmasq can be told to parse more than one resolv.conf
622 file. This is useful on a laptop, where both PPP and DHCP may be used:
623 dnsmasq can be set to poll both
624 .I /etc/ppp/resolv.conf
626 .I /etc/dhcpc/resolv.conf
627 and will use the contents of whichever changed
628 last, giving automatic switching between DNS servers.
630 Upstream servers may also be specified on the command line or in
631 the configuration file. These server specifications optionally take a
632 domain name which tells dnsmasq to use that server only to find names
633 in that particular domain.
635 In order to configure dnsmasq to act as cache for the host on which it is running, put "nameserver 127.0.0.1" in
637 to force local processes to send queries to
638 dnsmasq. Then either specify the upstream servers directly to dnsmasq
641 options or put their addresses real in another file, say
642 .I /etc/resolv.dnsmasq
643 and run dnsmasq with the
644 .B \-r /etc/resolv.dnsmasq
645 option. This second technique allows for dynamic update of the server
646 addresses by PPP or DHCP.
648 Addresses in /etc/hosts will "shadow" different addresses for the same
649 names in the upstream DNS, so "mycompany.com 1.2.3.4" in /etc/hosts will ensure that
650 queries for "mycompany.com" always return 1.2.3.4 even if queries in
651 the upstream DNS would otherwise return a different address. There is
652 one exception to this: if the upstream DNS contains a CNAME which
653 points to a shadowed name, then looking up the CNAME through dnsmasq
654 will result in the unshadowed address associated with the target of
655 the CNAME. To work around this, add the CNAME to /etc/hosts so that
656 the CNAME is shadowed too.
659 The network-id system works as follows: For each DHCP request, dnsmasq
660 collects a set of valid network-id tags, one from the
662 used to allocate the address, one from any matching
664 and possibly many from matching vendor classes and user
665 classes sent by the DHCP client. Any
667 which has network-id tags will be used in preference to an untagged
669 provided that _all_ the tags match somewhere in the
670 set collected as described above. The prefix '#' on a tag means 'not'
671 so --dhcp=option=#purple,3,1.2.3.4 sends the option when the
672 network-id tag purple is not in the set of valid tags.
674 If the network-id in a
676 is prefixed with 'net:' then its meaning changes from setting a
677 tag to matching it. Thus if there is more than dhcp-range on a subnet,
678 and one is tagged with a network-id which is set (for instance
679 from a vendorclass option) then hosts which set the netid tag will be
680 allocated addresses in the tagged range.
682 The DHCP server in dnsmasq will function as a BOOTP server also,
683 provided that the MAC address and IP address for clients are given,
690 configuration option is present to activate the DHCP server
691 on a particular network. (Setting --bootp-dynamic removes the need for
692 static address mappings.) The filename
693 parameter in a BOOTP request is matched against netids in
695 configurations, allowing some control over the options returned to
696 different classes of hosts.
699 .IR /etc/dnsmasq.conf
701 .IR /usr/local/etc/dnsmasq.conf
709 .IR /var/lib/misc/dnsmasq.leases
711 .IR /var/db/dnsmasq.leases
713 .IR /var/run/dnsmasq.pid
718 This manual page was written by Simon Kelley <simon@thekelleys.org.uk>.
projects / people / ms / dnsmasq.git / blob