Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'd like to use dnsmasq to set up a white list for certain clients on my network.

For instance, I'd like to have these rules for clients in the range 192.168.1.10 - 192.168.1.20:

no-resolv
server=/pbskids.org/192.168.0.1
server=/disney.go.com/192.168.0.1

This way, the only websites accessible from these clients are the ones that are whitelisted. Clients on the network outside of that range should be able to use whatever DNS server they want. How can I do this?

EDIT:

This is what I have in dnsmasq.conf so far:

bogus-priv
domain-needed
no-resolv

server=/pbskids.org/192.168.0.1
server=/disney.go.com/192.168.0.1

This has the intended result of denying upstream DNS lookups to all clients on the network. Now what I need is a way to allow certain clients to use upstream DNS instead. I don't think an option like this exists but maybe it will help get my idea across:

use-resolv --source 192.168.1.150

i.e., if the client's IP address is 192.168.1.150 then use upstream DNS servers. Alternatively, what I was originally looking for was something like this:

no-resolv --source 192.168.1.100

i.e., if the client's IP address is 192.168.1.100 then don't use upstream servers at all. I hope this helps clarify my question.

If I can't do something like this, then maybe what I need is two separate networks.

share|improve this question
    
This sounds like what you want: teknynja.com/2009/06/to-protect-and-surf-dnsmasq-and.html –  slm Nov 7 '13 at 3:00
    
That's where I started :) –  Koveras Nov 7 '13 at 4:57
add comment

1 Answer

This tutorial sounds like what you want. Titled: To Protect and Surf (dnsmasq and Whitelists).

The idea is fairly simple. Isolate machines so that their only DNS server they're aware of is the DNSMasq server. Then add the following lines to DNSMasq's config. file, /etc/dnsmasq.conf:

domain-needed
bogus-priv
log-queries
log-facility=/var/log/dnsmasq.log
no-resolv
interface=eth0

# Add other name servers here, with domain specs if they are for
# non-public domains.
#server=/localnet/192.168.0.1
server=/google.com/192.168.0.1
server=/dan-dare.org/192.168.0.1
server=/dan-dare.net/192.168.0.1
server=/pbskids.org/192.168.0.1
server=/playhousedisney.com/192.168.0.1
server=/disney.go.com/192.168.0.1
server=/starfall.com/192.168.0.1

Once you have this in place the servers pointing to the DNSMasq server will simply not be able to find any DNS results besides the ones in the config. file.

NOTE: This is by no means full proof and can be circumvented pretty easily. But if you're using it to keep children off of other websites, then it's probably enough for the task.

DNS

You can setup a system so that its DNS is configured to only send requests to the DNSMasq server through the configuration file, /etc/resolv.conf.

nameserver 192.168.1.1
share|improve this answer
    
How do I "Isolate machines so that their only DNS server they're aware of is the DNSMasq server"? –  Koveras Nov 7 '13 at 3:42
    
@davidkennedy85 - depends on how your network is setup, but the easiest method would be to edit the /etc/resolv.conf file and add the IP of the dnsmaq server. –  slm Nov 7 '13 at 3:58
    
Unfortunately I don't have a way to enforce local policies like that. I need a way to force nameservers at the proxy level, if that makes sense. –  Koveras Nov 7 '13 at 5:00
    
@davidkennedy85 - can you explain the situation more then? Ultimately the solution, if any, is going to hinge on how you have your environment setup. Try and focus on the computers and how they're accessing the internet. Do they use DHCP? Is there a single computer doing NAT in a home network or is this a business? –  slm Nov 7 '13 at 8:22
    
Sorry it took me a while to get back to you, I got distracted. Let's just say I have a wireless hotspot, and I don't want just anyone who jumps on the network to be able to access whatever they want. Certain clients should be able to however. At this point I'm thinking that I need two separate networks unfortunately, which most likely means investing in extra hardware. It would be cool if dnsmasq could handle this but if not then oh well. –  Koveras Dec 9 '13 at 20:47
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.