Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to use dnsmasq to set up a white list for certain clients on my network.

For instance, I'd like to have these rules for clients in the range -


This way, the only websites accessible from these clients are the ones that are whitelisted. Clients on the network outside of that range should be able to use whatever DNS server they want. How can I do this?


This is what I have in dnsmasq.conf so far:



This has the intended result of denying upstream DNS lookups to all clients on the network. Now what I need is a way to allow certain clients to use upstream DNS instead. I don't think an option like this exists but maybe it will help get my idea across:

use-resolv --source

i.e., if the client's IP address is then use upstream DNS servers. Alternatively, what I was originally looking for was something like this:

no-resolv --source

i.e., if the client's IP address is then don't use upstream servers at all. I hope this helps clarify my question.

If I can't do something like this, then maybe what I need is two separate networks.

share|improve this question
This sounds like what you want: teknynja.com/2009/06/to-protect-and-surf-dnsmasq-and.html – slm Nov 7 '13 at 3:00
That's where I started :) – Dave Kennedy Nov 7 '13 at 4:57

This tutorial sounds like what you want. Titled: To Protect and Surf (dnsmasq and Whitelists).

The idea is fairly simple. Isolate machines so that their only DNS server they're aware of is the DNSMasq server. Then add the following lines to DNSMasq's config. file, /etc/dnsmasq.conf:


# Add other name servers here, with domain specs if they are for
# non-public domains.

Once you have this in place the servers pointing to the DNSMasq server will simply not be able to find any DNS results besides the ones in the config. file.

NOTE: This is by no means full proof and can be circumvented pretty easily. But if you're using it to keep children off of other websites, then it's probably enough for the task.


You can setup a system so that its DNS is configured to only send requests to the DNSMasq server through the configuration file, /etc/resolv.conf.

share|improve this answer
How do I "Isolate machines so that their only DNS server they're aware of is the DNSMasq server"? – Dave Kennedy Nov 7 '13 at 3:42
@davidkennedy85 - depends on how your network is setup, but the easiest method would be to edit the /etc/resolv.conf file and add the IP of the dnsmaq server. – slm Nov 7 '13 at 3:58
Unfortunately I don't have a way to enforce local policies like that. I need a way to force nameservers at the proxy level, if that makes sense. – Dave Kennedy Nov 7 '13 at 5:00
@davidkennedy85 - can you explain the situation more then? Ultimately the solution, if any, is going to hinge on how you have your environment setup. Try and focus on the computers and how they're accessing the internet. Do they use DHCP? Is there a single computer doing NAT in a home network or is this a business? – slm Nov 7 '13 at 8:22
Sorry it took me a while to get back to you, I got distracted. Let's just say I have a wireless hotspot, and I don't want just anyone who jumps on the network to be able to access whatever they want. Certain clients should be able to however. At this point I'm thinking that I need two separate networks unfortunately, which most likely means investing in extra hardware. It would be cool if dnsmasq could handle this but if not then oh well. – Dave Kennedy Dec 9 '13 at 20:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.