1 DNS and DHCP configuration
2 ==========================
4 The _dnsmasq_ and dhcpd configuration is located in '/etc/config/dhcp' and controls both DNS and DHCP server options on the device (both DHCP and DNS services are implemented using the same OpenWrt program, dnsmasq).
6 In the default configuration this file contains one _common section_ to specify DNS and daemon related options and one or more _DHCP pools_ to define DHCP serving on network interfaces.
10 Possible section types of the 'dhcp' configuration file are defined below. Not all types may appear in the file and most of them are only needed for special configurations. The common ones are the _Common Options_, the _DHCP Pools_ and _Static Leases_.
14 The config section type 'dnsmasq' determines values and options relevant to the overall operation of dnsmasq and the DHCP options on all interfaces served. The following table lists all available options, their default value, as well as the corresponding _dnsmasq_ command line option. See [[http:_www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html|the dnsmasq man page]] for further details.
16 These are the default settings for the common options:
23 option localise_queries 1
24 option rebind_protection 1
25 option rebind_localhost 0
30 option authoritative 1
32 option leasefile '/tmp/dhcp.leases'
33 option resolvfile '/tmp/resolv.conf.auto'
36 * Options 'local' and 'domain' enable _dnsmasq_ to serve entries in '/etc/hosts' as well as the DHCP client's names as if they were entered into the _lan_ DNS domain.
37 * Options 'domainneeded', 'boguspriv', 'localise_queries', and 'expandhosts' make sure that requests for these local host names (and the reverse lookup) never get forwarded to the upstream DNS servers.
38 * Option 'authoritative' makes the router the only DHCP server on this network; clients get their IP lease a lot faster this way.
39 * Option 'leasefile' stores the leases in a file, so that they can be picked up again if _dnsmasq_ is restarted.
40 * Option 'resolvfile' tells _dnsmasq_ to use this file to find upstream name servers; it gets created by the WAN DHCP client or the PPP client.
41 * Options "enable_tftp" and "tftp_root" turn on the TFTP server and serve files from tftp_root. You may need to set the server's IP on the client. On the client, change it by setting "serverip" (e.g. "setenv serverip 192.168.1.10").
44 [cols="4*1,4",options="header"]
46 | Name | Type | Default | Option | Description
47 | 'add_local_domain' | boolean | '1' | | Add the local domain as search directive in resolv.conf.
48 | 'add_local_hostname' | boolean | '1' | | Add A and PTR records automatically for the local hostname.
49 | 'addnhosts' | list of file paths | _(none)_ | '-H' | Additional host files to read for serving DNS responses
50 | 'authoritative' | boolean | '0' | '-K' | Force _dnsmasq_ into authoritative mode. This speeds up DHCP leasing. Used if this is the only server on the network
51 | 'bogusnxdomain' | list of IP addresses | _(none)_ | '-B' | IP addresses to convert into NXDOMAIN responses (to counteract "helpful" upstream DNS servers that never return NXDOMAIN).
52 | 'boguspriv' | boolean | '0' | '-b' | Reject reverse lookups to private IP ranges where no corresponding entry exists in '/etc/hosts'
53 | 'cachelocal' | boolean | '1' | | When set to '0', use each network interface's 'dns' address in the local '/etc/resolv.conf'. Normally, only the loopback address is used, and all queries go through _dnsmasq_.
54 | 'cachesize' | integer | '150' | '-c' | Size of _dnsmasq_ query cache.
55 | 'dbus' | boolean | '0' | '-1' | Enable DBus messaging for _dnsmasq_.\\ CAUTION: Standard builds of _dnsmasq_ on OpenWRT do not include DBus support.
56 | 'dhcp_boot' | string | _(none)_ |--dhcp-boot>| Specifies BOOTP options, in most cases just the file name
57 | 'dhcphostsfile' | file path | _(none)_ | --dhcp-hostsfile | Specify an external file with per host DHCP options
58 | 'dhcpleasemax' | integer | '150' | '-X' | Maximum number of DHCP leases
59 | 'dnsforwardmax' | integer | '150' | '-0' (zero) | Maximum number of concurrent connections
60 | 'domain' | domain name | _(none)_ | '-s' | DNS domain handed out to DHCP clients
61 | 'domainneeded' | boolean | '0' | '-D' | Tells _dnsmasq_ never to forward queries for plain names, without dots or domain parts, to upstream nameservers. If the name is not known from /etc/hosts or DHCP then a "not found" answer is returned
62 | 'dnssec' | boolean | '0' | --dnssec | Validate DNS replies and cache DNSSEC data.\\ CAUTION: Requires the _dnsmasq-full_ package.
63 | 'dnsseccheckunsigned' | boolean | '0' | --dnssec-check-unsigned | Check the zones of unsigned replies to ensure that unsigned replies are allowed in those zones. This protects against an attacker forging unsigned replies for signed DNS zones, but is slower and requires that the nameservers upstream of _dnsmasq_ are DNSSEC-capable.\\ CAUTION: Requires the _dnsmasq-full_ package.\\ CAUTION: Caution: If you use this option on a device that doesn't have a hardware clock, dns resolution may break after a reboot of the device due to an incorrect system time.
64 | 'ednspacket_max' | integer | '1280' | '-P' | Specify the largest EDNS.0 UDP packet which is supported by the DNS forwarder
65 | 'enable_tftp' | boolean | '0' | --enable-tftp | Enable the builtin TFTP server
66 | 'expandhosts' | boolean | '0' | '-E' | Add the local domain part to names found in '/etc/hosts'
67 | 'filterwin2k' | boolean | '0' | '-f' | Do not forward requests that cannot be answered by public name servers
68 | 'fqdn' | boolean | '0' | --dhcp-fqdn | Do not resolve unqualifed local hostnames. Needs 'domain' to be set.
69 | 'interface' | list of interface names | _(all interfaces)_ | '-i' | List of interfaces to listen on. If unspecified, _dnsmasq_ will listen to all interfaces except those listed in 'notinterface'. Note that _dnsmasq_ listens on loopback by default.
70 | 'leasefile' | file path | _(none)_ | '-l' (ell) | Store DHCP leases in this file
71 | 'local' | string | _(none)_ | '-S' | Look up DNS entries for this domain from '/etc/hosts'. This follows the same syntax as 'server' entries, see the man page.
72 | 'localise_queries' | boolean | '0' | '-y' | Choose IP address to match the incoming interface if multiple addresses are assigned to a host name in '/etc/hosts'. CAUTION: Note well the spelling of this option.
73 | 'localservice' | boolean | '1' | --local-service | Accept DNS queries only from hosts whose address is on a local subnet, ie a subnet for which an interface exists on the server.
74 | 'logqueries' | boolean | '0' | '-q' | Log the results of DNS queries, dump cache on SIGUSR1
75 | 'nodaemon' | boolean | '0' | '-d' | Don't daemonize the _dnsmasq_ process
76 | 'nohosts' | boolean | '0' | '-h' | Don't read DNS names from '/etc/hosts'
77 | 'nonegcache' | boolean | '0' | '-N' | Disable caching of negative "no such domain" responses
78 | 'noresolv' | boolean | '0' | '-R' | Don't read upstream servers from '/etc/resolv.conf'
79 | 'notinterface' | list of interface names | _(none)_ | '-I' (eye) | Interfaces _dnsmasq_ should not listen on.
80 | 'nonwildcard' | boolean | '0' | '-z' | Bind only configured interface addresses, instead of the wildcard address.
81 | 'port' | port number | '53' | '-p' | Listening port for DNS queries, disables DNS server functionality if set to '0'
82 | 'queryport' | integer | _(none)_ | '-Q' | Use a fixed port for outbound DNS queries
83 | 'readethers' | boolean | '0' | '-Z' | Read static lease entries from '/etc/ethers', re-read on SIGHUP
84 | 'rebind_protection' | boolean | '1' | --stop-dns-rebind | Enables DNS rebind attack protection by discarding upstream RFC1918 responses
85 | 'rebind_localhost' | boolean | '0' | --rebind-localhost-ok | Allows upstream 127.0.0.0/8 responses, required for DNS based blacklist services, only takes effect if rebind protection is enabled
86 | 'rebind_domain' | list of domain names | _(none)_ | --rebind-domain-ok | List of domains to allow RFC1918 responses for, only takes effect if rebind protection is enabled
87 | 'resolvfile' | file path | '/etc/resolv.conf' | '-r' | Specifies an alternative resolv file
88 | 'server' | list of strings | _(none)_ | '-S' | List of DNS servers to forward requests to. See the _dnsmasq_ man page for syntax details.
89 | 'strictorder' | boolean | '0' | '-o' | Obey order of DNS servers in '/etc/resolv.conf'
90 | 'tftp_root' | directory path | _(none)_ | --tftp-root | Specifies the TFTP root directory
95 Sections of the type 'dhcp' specify per interface lease pools and settings for serving DHCP requests.
96 Typically there is at least one section of this type present in the '/etc/config/dhcp' file to cover the lan interface.
98 You can disable a lease pool for a specific interface by specifying the 'ignore' option in the corresponding section.
100 A minimal example of a 'dhcp' section is listed below:
104 option 'interface' 'lan'
107 option 'leasetime' '12h'
112 * 'lan' specifies the OpenWrt interface that is served by this DHCP pool
113 * '100' is the offset from the network address, in the default configuration this would mean start leasing addresses from '192.168.1.100'
114 * '150' is the maximum number of addresses that may be leased, in the default configuration this would mean leasing addresses up to '192.168.1.250'
115 * '12h' specifies the time to live for handed out leases, twelve hours in this example
116 * 'server' defines the mode for IPv6 configuration (RA & DHCPv6)
118 Below is a listing of legal options for 'dhcp' sections.
120 [cols="4*1,4",options="header"]
122 | Name | Type | Required | Default | Description
123 | 'dhcp_option' | list of strings | no | _(none)_ | The ID dhcp_option here must be with written with an underscore. OpenWrt will translate this to --dhcp-option, with a hyphen, as ultimately used by dnsmasq. Multiple option values can be given for this _network-id_, with a a space between them and the total string between "". E.g. '26,1470' or 'option:mtu, 1470' that can assign an MTU per DHCP. Your client must accept MTU by DHCP for this to work. Or "3,192.168.1.1 6,192.168.1.1" to give out gateway and dns server addresses.
124 | 'dynamicdhcp' | boolean | no | '1' | Dynamically allocate client addresses, if set to '0' only clients present in the 'ethers' files are served
125 | 'force' | boolean | no | '0' | Forces DHCP serving on the specified interface even if another DHCP server is detected on the same network segment
126 | 'ignore' | boolean | no | '0' | Specifies whether _dnsmasq_ should ignore this pool if set to '1'
127 | 'dhcpv6' | string | no | 'none' | Specifies whether DHCPv6 server should be enabled ('server'), relayed ('relay') or disabled ('disabled')
128 | 'ra' | string | no | 'none' | Specifies whether Router Advertisements should be enabled ('server'), relayed ('relay') or disabled ('disabled')
129 | 'ndp' | string | no | 'none' | Specifies whether NDP should be relayed 'relay' or disabled 'none'
130 | 'master' | boolean | no | 0 | Specifies whether DHCPv6, RA and NDP in relay mode is a master interface or not.
131 | 'interface' | logical interface name | yes | _(none)_ | Specifies the interface associated with this DHCP address pool; must be one of the interfaces defined in '/etc/config/network'.
132 | 'leasetime' | string | yes | '12h' | Specifies the lease time of addresses handed out to clients, for example '12h' or '30m'
133 | 'limit' | integer | yes | '150' | Specifies the size of the address pool (e.g. with start=100, limit=150, maximum address will be .249)
134 | 'networkid' | string | no | _(value of 'interface')_ | The dhcp functionality defined in the dhcp section is limited to the interface indicated here through its _network-id_. In case omitted the system tries to know the network-id via the 'interface' setting in this dhcp section, through consultation of /etc/config/network. Some IDs get assigned dynamically, are not provided by network, but still can be set here.
135 | 'start' | integer | yes | '100' | Specifies the offset from the network address of the underlying interface to calculate the minimum address that may be leased to clients. It may be greater than 255 to span subnets.
140 * Although called 'interface', this is the network name, i.e. lan, wan, wifi etc. (section names in /etc/config/network), NOT the interface name used internally, like eth0, eth1, wlan0 etc. (the 'ifname' IDs in /etc/config/network).
141 * Although called 'networkid', this is the interface name used internally, i.e. eth0, eth1, wlan0 etc., not the network name (lan, wan, wifi etc.).
142 This departs from 'ifname' and 'network' as used in /etc/config/network and in /etc/config/wireless, so double check!
146 You can assign fixed IP addresses to hosts on your network, based on their MAC (hardware) address.
148 The configuration options in this section are used to construct a '-G' option for _dnsmasq_.
152 option ip '192.168.1.2'
153 option mac '00:11:22:33:44:55'
156 This adds the fixed IP address 192.168.1.2 and the name "mypc" for a machine with the (Ethernet) hardware address 00:11:22:33:44:55.
160 option ip '192.168.1.3'
161 option mac '11:22:33:44:55:66 aa:bb:cc:dd:ee:ff'
162 option name 'mylaptop'
164 This adds the fixed IP address 192.168.1.3 and the name "mylaptop" for a machine with the (Ethernet) hardware address 11:22:33:44:55:66 or aa:bb:cc:dd:ee:ff. Note that this is **unreliable** if more than one of the listed mac addresses is on the network simultaneously. It's useful for cases such as a laptop with both wireless and wired interfaces, provided that only one will be active at a given time.
166 [cols="4*1,4",options="header"]
168 | Name | Type | Required | Default | Description
169 | 'ip' | string | yes | _(none)_ | 'ignore' or the IP address to be used for this host.
170 | 'mac' | string | no | _(none)_ | The hardware address(es) of this host, separated by commas.
171 | 'hostid' | string | no | _(none)_ | The IPv6 interface identifier (address suffix) as hexadecimal number (max. 8 chars)
172 | 'duid' | string | no | _(none)_ | The DHCPv6-DUID of this host.
173 | 'name' | string | no | _(none)_ | Optional hostname to assign.
174 | 'tag' | string | no | _(none)_ | Set the given tag for matching hosts.
175 | 'dns' | boolean | no | '0' | Add static forward and reverse DNS entries for this host.
176 | 'broadcast' | boolean | no | '0' | Force broadcast DHCP response.
177 | 'leasetime' | string | no | _(none)_ | Host-specific lease time, e.g. 2m, 3h, 5d. Note: introduced by r48801 in trunk
180 As well as adding 'host' sections, you can also enable the 'dnsmasq' section option 'readethers', and add entries to the '/etc/ethers' file.
182 === DHCP OPTION example to set an alternative default gateway
184 You can specify an alternative default Gateway
188 option 'interface' 'lan'
191 option 'leasetime' '12h'
192 list 'dhcp_option' '3,192.168.1.2'
195 use the list 'dhcp_option' '3,192.168.1.2' to set the default gateway. A list of options can be found here [[http:_www.networksorcery.com/enp/protocol/bootp/options.htm | here]]
199 Some hosts support booting over the network (PXE booting). DHCP/BOOTP is used to tell the host which file to boot and the server to load it from. Each client can only receive one set of filename and server address options. If different hosts should boot different files, or boot from different servers, you can use _network-ids_ to map options to each client.
201 Usually, you need to set additional DHCP options (through 'dhcp_option') for further stages of the boot process. See the _dnsmasq_ man page for details on the syntax of the 'O' option.
203 The configuration options in this section are used to construct a '-M' option for _dnsmasq_.
205 *Note*: odhcp currently lacks support root-path specification. If you need this functionality, disable odhcpd and use dnsmasq instead.
209 option filename '/tftpboot/pxelinux.0'
210 option serveraddress '192.168.1.2'
211 option servername 'fileserver'
212 list dhcp_option 'option:root-path,192.168.1.2:/data/netboot/root'
214 This tells the client to load pxelinux.0 from the server at 192.168.1.2, and mount root from /data/netboot/root on the same server.
215 [cols="4*1,4",options="header"]
217 | Name | Type | Required | Default | Description
218 | 'dhcp_option' | list of strings | no | _(none)_ | Additional options to be added for this network-id. CAUTION: If you specify this, you also need to specify the network-id.
219 | 'filename' | string | yes | _(none)_ | The filename the host should request from the boot server.
220 | 'networkid' | string | no | _(none)_ | The network-id these boot options should apply to. Applies to all clients if left unspecified.
221 | 'serveraddress' | string | yes | _(none)_ | The IP address of the boot server.
222 | 'servername' | string | yes | _(none)_ | The hostname of the boot server.
223 | 'force' | bool | no | _(none)_ | dhcp-option will always be sent, even if the client does not ask for it in the parameter request list. This is sometimes needed, for example when sending options to PXELinux.
226 === Classifying Clients And Assigning Individual Options
228 DHCP can provide the client with numerous options, such as the domain name, NTP servers, network booting options, etc. While some settings are applicable to all hosts in a network segment, other are more specific and apply only to a group of hosts, or even only a single one. _dnsmasq_ offers to group DHCP options and their values by a _network-id_, an alphanumeric identifier, and sending options only to hosts which have been tagged with that _network-id_.
230 In OpenWrt, you can tag hosts by the DHCP range they're in (section 'dhcp'), or a number of options the client might send with their DHCP request. In each of these sections, you can use the 'dhcp_option' list to add DHCP options to be sent to hosts with this _network-id_.
232 Each classifying section has two configuration options: the value of the DHCP option used to distinguish clients, and the _network-id_ that these clients should be tagged with. Here's a template:
236 option _classifier_ '_value_'
237 option networkid '_network-id_'
238 list dhcp_option '_DHCP-option_'
241 The placeholder '_classifier_' can be one of these values:
242 [cols="1,4",options="header"]
244 | Classifier | Description
245 | 'mac' | Hardware address of the client
246 | 'vendorclass' | String sent by the client representing the vendor of the client. _dnsmasq_ performs a substring match on the vendor class string using this value.
247 | 'userclass' | String sent by the client representing the user of the client. _dnsmasq_ performs a substring match on the user class string using this value.
248 | 'circuitid' | Matches the circuit ID as sent by the relay agent, as defined in RFC3046.
249 | 'remoteid' | Matches the remote ID as sent by the relay agent, as defined in RFC3046.
250 | 'subscrid' | Matches the subscriber ID as sent by the relay agent, as defined in RFC3993.
254 An example using the 'mac' classifier to create a tagged network for openvpn would look like this in the config file:
258 option mac '00:FF:*:*:*:*'
259 option networkid 'opnvpn'
267 dhcp.opnvpn.mac=00:FF:*:*:*:*
268 dhcp.opnvpn.networkid=opnvpn
269 dhcp.opnvpn.dhcp_option=3
272 _DHCP-option_ adds a DHCP option for this _network-id_. See the _dnsmsq_ man page for a complete explanation of the syntax of the '-O' option.
274 _force_ is a bool option. It forces dhcp-option to always be sent, even if the client does not ask for it in the parameter request list. This is sometimes needed, for example when sending options to PXELinux.
277 == Using plain dnsmasq.conf
279 It is possible to mix the traditional '/etc/dnsmasq.conf' configuration file with the options found in '/etc/config/dhcp'.
281 The 'dnsmasq.conf' file does not exist by default but will be processed by _dnsmasq_ on startup if it is present. Note that options in '/etc/config/dhcp' take precendence over 'dnsmasq.conf' since they are translated to command line arguments.
283 You can have 'dnsmasq' execute a script on every action:
286 dhcp-script=/sbin/action.sh
289 === DNS and DHCP Ports
290 DNS needs TCP and UDP port 53 open on the firewall. DHCP needs UDP ports 67 and 68 open from your zone to/from the firewall. See http:_wiki.openwrt.org/doc/recipes/guest-wlan and http:_www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html (viz "--dhcp-alternate-port") for more information.
294 === Static Lease (MAC address hot swap)
296 Define a static lease for a host with MAC addresses '00:a0:24:5a:33:69' and '00:11:22:33:44:55' (handy when you use both wired and wireless connection on the same computer/laptop - of course, you can use just one MAC address) and assign the IP address '192.168.1.230' and the hostname 'example-host' to it. We call this _MAC address hot swap_, since IP address stay same, but MAC address changes.
300 option 'name' 'example-host'
301 option 'ip' '192.168.1.230'
302 option 'mac' '00:a0:24:5a:33:69 00:11:22:33:44:55'
305 === Troubleshooting ===
307 CAUTION: **Windows 7** has introduced a new _Microsoft-enhanced_ feature. It won't assign IP address obtained from a DHCP server to an interface, if the IP was used before for another interface, even if that other interface is **NOT** active currently (i.e. cable disconnected). This behaviour is unique and was not reported for older Windows versions, Mac OS nor Linux.
309 If you try configure MAC address hot swap on your router, Windows 7 clients will end up in an infinite [[http:_tools.ietf.org/html/rfc1531#section-3.1|DORA]] loop.
312 - Create a bridge from the wireless and ethernet interfaces on your client
314 * it's trivial: [[googe>windows 7 create bridge|google it]]
315 * you will have to add the MAC address of the bridge to '/etc/config/dhcp'
319 option 'name' 'example-host'
320 option 'ip' '192.168.1.230'
321 option 'mac' '00:a0:24:5a:33:69 00:11:22:33:44:55 02:a0:24:5a:33:69 02:11:22:33:44:55'
323 * Since the bridge will probably take and alter your ethernet MAC address, you will lose SLAAC on wifi interface, making your laptop IPv6-disabled when only wireless is up.
324 - Another solution is IPv6 friendly, you don't need to create a bridge, nor add MAC address to dnsmasq config file, but it involves user interaction:
325 * When you plug the ethernet cable in, disable wireless interface in control panel (power off wireless won't do it).
326 * When you unplug ethernet cable, enable wireless and disable ethernet.
330 * http:_answers.microsoft.com/en-us/windows/forum/windows_7-networking/windows-7-refuses-dhcp-addresses-if-they-were/1b72b289-0f58-492f-afb8-e76c80a81f00
331 * _force_ is a bool option that will force dhcp-option to always be sent, even if the client does not ask for it in the parameter request list. This is sometimes needed, for example when sending options to PXELinux.
333 === Only allow static leases
335 If you want to distribute IPv4 addresses to known clients only (static leases), use:
343 With this, dnsmasq will consider static leases defined in "config host" blocks and in /etc/ethers, and refuse to hand out any IPv4 address to unknown clients.
345 Note that you shouldn't use this as a security feature to prevent unwanted clients from connecting. A client can simply configure a static IP in the right range to have access to the network.
349 Define a custom domain name and the corresponding PTR record - assigns the IP address '192.168.1.140' to the domain name 'typhoon' and construct an appropriate reverse record '140.1.168.192.in-addr.arpa'. It works like an entry in '/etc/hosts' but more flexible
352 CAUTION: Note that this currently only works for IPv4 addresses and that this functionality is not present in release prior to 8.09.2 .
354 CAUTION: Note that reverse records are not properly generated at present. (Barrier Breaker 14.07-RC2)
358 option 'name' 'typhoon'
359 option 'ip' '192.168.1.140'
363 another example: redirect www.facebook.com
366 option 'name' 'www.facebook.com'
367 option 'ip' '1.2.3.4'
368 #the request to www.facebook.com will end to 1.2.3.4
373 To define an SRV record for SIP over UDP, with the default port of 5060 on the host pbx.mydomain.com, with a class of 0 and a weight of 10 one would use:
377 option srv '_sip._udp.mydomain.com'
378 option target 'pbx.mydomain.com'
386 A Canonical Name record specifes that a domain name is an alias for another domain, the "canonical" domain. To specify that the web server also doubles as the FTP server, one might use:
390 option cname 'ftp.example.com'
391 option target 'www.example.com'
393 Note that it is necessary to use fully qualified domain names.
397 If you're running the mail server for your domain behind a firewall (and therefore, with split-horizon for your own domain) then you might need to convince that mailer that it's actually authoritative for your domain.
399 If sendmail tells you "Domain of sender address xxx@yyy.zzz does not exist" this is because it isn't finding an MX record confirming that it's an MX relay for that domain.
405 option domain 'yyy.zzz'
406 option relay 'my.host.com'
410 will mitigate the issues caused by split-horizon.
414 Direct BOOTP requests to the TFTP server at the IP address '192.168.1.2' and use '/tftpboot/pxelinux.0' as boot file name.
418 option 'filename' 'pxelinux.0'
419 option 'servername' 'data'
420 option 'serveraddress' '192.168.1.2'
423 === Multiple DHCP options
425 Multiple DHCP options can be configured under a single dhcp_option object. In this case, option 66 (tftp-server) and option 150 (multiple tftp servers) were used for a Cisco Callmanager deployment.
429 option 'interface' 'lan'
432 option 'leasetime' '600h'
433 list 'dhcp_option' '66,172.16.60.64'
434 list 'dhcp_option' '150,172.16.60.64'
437 === Multiple DHCP/DNS server/forwarder instances
439 If you need multiple DNS forwarders with different configurations or DHCP server with different sets of lease files,
440 have a look at this [[https:_dev.openwrt.org/ticket/8862|patch]].
441 Multiple dnsmasq "named" instances can be configured:
443 config 'dnsmasq' 'hotspot'
444 option nonwildcard '1' # Tell dnsmasq to bind specific address(es)
445 option resolvfile '/tmp/resolv.conf.hotspot'
449 Your configs are usally active for all instances, but you can limit them to single instances by:
452 option 'interface' 'lan'
453 option 'dnsmasq_config' 'hotspot'
457 option 'mac' '00:00:00:00:00:00'
458 option 'ip' '192.168.1.66'
459 option 'dnsmasq_config' 'hotspot'
462 The web interface (luci) has not been updated for this patch yet.
464 === Assigning DHCP pool to a subnet in a large network
466 In DHCP pool limit setting, the start and limit values do *not* refer to the "last digit", they're relative offsets to the network address.
467 * the network address of 10.0.0.1 / 255.0.0.0 is 10.0.0.0
468 * the 10.22.0.1 start address is 22 x /16 subnets away: (2^16) * 22 = 1441792
469 * 10.0.0.0 + 1441792 + 1 = 10.22.0.1 -> start = 1441793
470 * 10.22.0.254 - 10.22.0.1 = 253 -> limit = 253
482 root@OpenWrt:~# ipcalc.sh 10.0.0.1 255.0.0.0 1441793 253
485 BROADCAST=10.255.255.255
493 === Classifying Clients And Assigning Individual Options
495 Assign different dhcp-options to a single MAC address:
500 set dhcp.@mac[-1].mac=00:11:22:33:44:55
501 set dhcp.@mac[-1].networkid=someone
502 add_list dhcp.@mac[-1].dhcp_option=6,192.168.1.3,192.168.1.2,192.168.1.1
503 add_list dhcp.@mac[-1].dhcp_option=3,192.168.1.2
504 add_list dhcp.@mac[-1].dhcp_option=44,192.168.1.3
508 /etc/init.d/dnsmasq reload
510 Where 6=DNS, 3=Default Gateway, 44=WINS
512 Assign different dhcp-options to multiple hosts:
517 option mac '00:21:63:75:aa:17'
518 option ip '10.11.12.14'
519 option tag 'vpn' # assign tag "vpn" to this host
523 option mac '01:22:64:76:bb:18'
524 option ip '10.11.12.15'
525 option tag 'vpn' # assign tag "vpn" to this host
527 config tag 'vpn' # match tag "vpn"
528 list dhcp_option '6,8.8.8.8,8.8.4.4' # assign arbritary extra dhcp options to this tag
529 option force '1' #dhcp-option will always be sent, even if the client does not ask for it in the parameter request list. This is sometimes needed, for example when sending options to PXELinux.
532 CAUTION: Generally, specifying a dhcp option without any value, would disable that option. so for example you can use:
536 to disable sending a default gateway to a specific client
538 WARNING: Convert to procd: etc/init.d/dnsmasq restart
540 === Enabling DHCP without enabling DNS
542 This is useful when you just want to hand out addresses to clients, without doing any DNS.
551 The second option prevents dnsmasq from giving out a domain name and DNS search list to clients: this is useless without DNS resolving.
553 Of course, you will want to hand out the address of a DNS resolver to clients:
559 list dhcp_option "6,80.67.188.188,6,80.67.169.12"
560 list dns "2001:913::8"
561 list dns "2001:910:800::12"
564 The `dhcp_option` entry is meant for dnsmasq, while the more elegant `dns` entries are understood by odhcpd. By default, odhcpd is only used for IPv6, but if you also use odhcpd for IPv4, you can just use `dns` entries for everything.
566 === Enabling DNS without enabling DHCP
568 dnsmasq can be used to provide clients with a DNS server but not with DHCP (for example, if DHCP is already supplied by a separate server).
570 First, dnsmasq must be turned on for the internal interface:
572 * Network > Interfaces
573 * click the desired internal interface to select it
575 * click the "Setup DHCP Server" button to enable dnsmasq on this interface -- this will enable both DHCP and DNS
577 Now that dnsmasq is enabled, the DHCP portion of dnsmasq needs to be turned off.
579 * Network > Interfaces
580 * click the desired internal interface to select it
582 * Ignore interface: Enable this option
585 This change will turn off just DHCP but leave DNS services available on the specified interface.
587 === Several DNS servers
591 option domainneeded '1'
592 option localise_queries '1'
595 option expandhosts '1'
596 option authoritative '1'
597 option readethers '1'
598 option leasefile '/tmp/dhcp.leases'
599 option resolvfile '/tmp/resolv.conf.auto'
600 list server '/subdomain.example.com/192.0.2.1'
601 #be careful that some options should be absent (or set to False)
602 #to allow the forwarding towards the "so defined" private networks
603 #http:_en.wikipedia.org/wiki/Private_network
604 # likely 'bogusprivat'
605 list server '/example.com/208.67.222.222'
606 option rebind_protection '0'
611 === Conditional DNS Forwarding for Windows Active Directory Domains / DNS Dependent Directory Based Authentication Services
613 1. Install dnsmasq using your local package manager
614 2. Edit /etc/dnsmasq.conf
615 . Tells dnsmasq to forward anything with the domain of remote.local to dns server 10.25.11.2
616 server=/remote.local/10.25.11.2
617 . Listen to requests only coming from the local machine
618 listen-address=127.0.0.1
619 . Do not cache anything
620 . A decent dns server will already cache for your local network
622 3. Edit /etc/resolv.conf
627 . local dnsmasq server
630 . Your main dns server (dnsmasq will forward all requests to this server)
634 5. Test – ping a local server and remote server using the FQDN
636 All dns requests will be forwarded to 10.20.1.1 except any matching *.remote.local. server.remote.local will be forwarded to 10.25.11.2
638 Credit: [[http:_pyther.net/2010/12/dns-conditional-forwarding-dnsmasq/]]
645 option localise_queries '1'
646 option rebind_protection '0'
647 option authoritative '1'
648 option leasefile '/tmp/dhcp.leases'
649 option localservice '1'
652 option domain 'example.local'
653 option readethers '1'
654 option logqueries '1'
655 option fliterwin2k '0'
656 #Define your Domain and Domain Controllers IP address here.
657 option local '/example.local/192.168.1.X'**
658 list server '/0.openwrt.pool.ntp.org/8.8.8.8'
659 list server '/1.openwrt.pool.ntp.org/8.8.8.8'
660 list server '/2.openwrt.pool.ntp.org/8.8.8.8'
661 list server '/3.openwrt.pool.ntp.org/8.8.8.8'
662 option resolvfile '/etc/resolv.conf'
666 option interface 'lan'
669 option leasetime '12h'
671 Almost completed, Now on to the finalization of the /etc/resolv.conf Traditionally /etc/resolv.conf is populated via symlink based on interface settings which get inserted via script into /tmp/resolv.conf. We're going to disable this symlink because without doing so it would override our static settings.
673 You'll want to remove /etc/resolv.conf
674 That will remove the resolv.conf symlink. Then we will add the ip address of the secondary DNS and external resolving address inside the /etc/resolv.conf file finally establishing conditional forwarding, something that should be specified for easy configuration via the GUI.
678 echo "domain example.local">>/etc/resolv.conf
679 echo "nameserver 127.0.0.1">>/etc/resolv.conf
680 echo "nameserver 208.67.220.220">>/etc/resolv.conf
687 #Define your Domain Below & Public DNS you desire.
691 nameserver 208.67.220.220
697 === Losing connection due to missing dhcp response when the network is overloaded
699 Sometimes when an interface is on the edge of the capacity (especially wifi over longer distances) a dhcp request could be not replied in time and therefore the dhcp client will not be able to receive proper network settings. A possible workaround is using static IPs or very long dhcp leases (more than 12h). This is particularly important when one has several wifi repeaters that use dhcp and are distant from each other or not easily accessible.
projects / web.git / blob