1

On a headless Ubuntu 14.04 vanilla machine I setup dnsmasq as a DNS proxy with the following configuration in /etc/dnsmasq.conf

no-resolv
nameserver=<some working custom dns ip>
port=5555 #to circumvent my ISP's DNS hijacking

Whenever the dnsmasq service is started, the host machine lose ability to resolve any hostnames, however the dnsmasq resolves external queries just fine. A check into /etc/resolv.conf shows only one line of

nameserver 127.0.0.1

So I added a few nameservers to /etc/resolvconf/resolv.conf.d/base and rebooted the machine. The problem still persists even though the added nameservers appears in /etc/resolv.conf

1

I think you've got multiple problems.

First: port=5555 - this means that the dnsmasq process will listen for DNS queries on UDP (and probably TCP) port 5555. All of the DNS clients of your dnsmasq will have to query on that port, otherwise they won't get an answer. Your ISP's DNS hijacking is not material to this. I suspect you don't want to configure a non-standard port because of the next problem...

Second, the file /etc/resolv.conf is what processes that use the libc resolver to do DNS will read to find the dnsmasq process. That's for processes on the "headless Ubuntu 14.04" machine. The nameserver 127.0.0.1 line is appropriate in this file. Since you've apparently got dnsmaq listening on port 5555, this file is where you'd specify the port number other processes would use to query dnsmasq. After googling around, I see that OpenBSD's libresolv can specify non-standard ports in /etc/resolv.conf, but I can't tell if any of the usual resolvers can read this. Give it a try, I'd say. Use: nameserver 127.0.0.1:5555 and see if that makes a difference. Use something like the ping www.google.com command - it uses the libc resolver to get an IP address for the name "www.google.com".

Third, if you're trying to work around some ISP's hijacking of DNS, you're going to have to find a DNS server somewhere in the world that listens on a port other than 53. This sort of configuration doesn't appear to exist. Blog posts on circumventing DNS hijacking list this as a major obstacle. I don't know what to recommend here, but ulitmately, you'll have to tell dnsmaq where to find such a server, and that file is usually /etc/dnsmasq.resolv.

  • This machine is a remote VPS, with the dnsmasq setup to listen on port 5555 and proxying the queries for me with the help of a local instance of acrylic (a windows dns proxy that supports alternate outbound port). What I was trying to do was prevent dnsmasq from changing local dns resolving to 127.0.0.1 somehow whenever dnsmasq service is started. I have included my solution below. – myopenid Mar 1 '15 at 9:19
0

Remove everything except for return 0 within the start_resolvconf() function of /etc/init.d/dnsmasq.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.