3

I have a Debian system that gets its IP from a DHCP server, with my own bind9 server running on localhost. Every time I boot, I have to write nameserver 127.0.0.1 to /etc/resolv.conf, as the system updates the file to match the DNS server assigned by DHCP. To try to prevent resolv.conf from getting updated with DNS server information from my network's DHCP server, I tried writing the following to /etc/network/interfaces:

iface eth0 inet dhcp
    dns-nameservers 127.0.0.1

but that only works when the system has a static IP.

So how can I prevent /etc/resolv.conf from getting overwritten with the DHCP server's assigned DNS server, without giving my system a static IP?

I use dhclient.

7

If you are sure you are using dhclient. You can:

1. Change dhclient setting (recommendded)

Edit the file /etc/dhcp/dhclient.conf, search for domain-name-servers, and delete it from the line:

request subnet-mask, broadcast-address, time-offset, routers,
    domain-name, domain-name-servers, domain-search, host-name,
    dhcp6.name-servers, dhcp6.domain-search, dhcp6.fqdn, dhcp6.sntp-servers,
    netbios-name-servers, netbios-scope, interface-mtu,
    rfc3442-classless-static-routes, ntp-servers;

2. Prevent /etc/resolv.conf from being overwritten

Running the following command as root or using sudo so that the file won't get overwritten again:

chattr +i /etc/resolv.conf

It's more or less a duplicated question to Can not set static DNS on debian. But I can't comment so I add this answer.

  • 2
    Please note this should be chattr +i. chattr -i has the opposite effect as what's deccribed here. – ollien Feb 24 at 5:31
  • when some other application is installed (network-manager ...) /etc/resolv.conf is a symlink to a file in a tmpfs filesystem, which doesn't support chattr +i . – A.B Feb 28 at 14:54
0

Remove the resolvconf package and your own /etc/resolv.conf will not be overwritten.

  • 1
    resolvconf already isn't installed on my system; thanks anyway. – Billy Feb 23 '17 at 23:44
0

It depends entirely where your getting your DHCP from.

On my systems (Ubuntu 16.04) I have the "isc-dhcp-server" package installed.

I then switched OFF the DHCP facility in my router/wifi/hub so that the only source of DHCP on my network was my own server.

Once this was done, I then installed "Webmin" and used the browser based tools in that to configure my DHCP server so that it

  • a) Always handed out the DNS server address to DHCP clients that I wanted it to
  • b) Set a specific range of IP addresses to hand out as DHCP for my network
  • c) Set a number of STATIC IP addresses based entirely on the mac address requesting it.

Here's a watered down sample of my /etc/dhcp/dhcpd.conf configuration file

ddns-updates off;
ddns-update-style none;
option time-servers 192.168.1.3;
option routers 192.168.1.1;
option domain-name "myinternal.domain.name";
option domain-name-servers 192.168.1.2;

default-lease-time 1800;
max-lease-time 7200;
authoritative;
log-facility local7;

get-lease-hostnames true;

subnet 192.168.1.0 netmask 255.255.255.0 {
  option time-servers 192.168.1.3;
  option ntp-servers 192.168.1.3;
  option domain-search "myinternal.domain.name";
  authoritative;
  ddns-updates off;
  range 192.168.1.200 192.168.1.254;
  option domain-name-servers 192.168.1.2;
  option domain-name "myinternal.domain.name";
  option routers 192.168.1.1;
  option broadcast-address 192.168.1.255;
  default-lease-time 1800;
  max-lease-time 7200;
  }

group {

  use-host-decl-names on;

# Physical lan machines that MUST always have the same IP address

  # DNS Server
  host dnsmachine {
    hardware ethernet 12:12:12:12:12:12; <--- REPLACE THIS WITH THE MACHINES ACTUAL MAC ADDRESS
    fixed-address 192.168.1.2;
  }

  # Time server
  host timemachine {
    hardware ethernet 12:12:12:12:12:12; <--- REPLACE THIS WITH THE MACHINES ACTUAL MAC ADDRESS
    fixed-address 192.168.1.3;
  }

}

It assumes you have a class C (24 bit net mask) subnet that allows addresses from 192.168.1.0 to 192.168.1.255

.0 and .255 are always reserved for broadcast and other special uses, which means your effective range is 192.168.1.1 to 192.168.1.254

We've set the DNS configuration to use "my.internal.domain.name" as your local domain name. This is YOUR PRIVATE local domain name inside your network, and registered in your own private local DNS.

You don't have to have a network time server, but for added completeness I've added one in along with a DNS server on 192.168.1.2 and 192.168.1.3 respectively

Iv'e set the general (IE: Random) DHCP range to go from 192.168.1.200 to 192.168.1.254 giving you 54 normal DHCP addresses to be handed out as needed, you can increase or decrease this as needed. For example, if you only ever have .2 & .3 as your only fixed addresses, then you could set the start to 192.168.1.4 if you wished.

The lower part of the config defines 2 fixed address machines. These machines identified by their appropriate MAC address will ALWAYS be given the specified fixed IP addresses, this is important for machines acting as servers (Such as DNS) as it always makes sure they can be found at the same address.

Our main config for the random DHCP leases then hands out those very same fixed IP's as the DNS & Time server addresses that will be reported to the clients requesting them.

All you then have to do is set the client machines to get ALL of their details entirely from DHCP, and as long as it's your DHCP service that responds and no other, they will always be assigned the configuration you specify.

  • Great post. I have my own DHCP server on my network, but I travel a lot (this system is a laptop) and I don't want my system querying the shady third-party DNS servers running on public networks. Thanks anyway. – Billy Feb 24 '17 at 0:55
  • Well you could do what I do (I travel a lot too) :-) - I have an ubuntu VM running inside virtual box on my lappy. It's an 8 core i7, beast of a thing so I hardly notice that it's there. (Life of a consultant) ;-) – shawty Feb 24 '17 at 0:57
-1

edit network file /etc/network/interfaces. and add PEERDNS="no" . This works in Fedora. Hope this work in Debian. You can also use chattr. so that no one can modify the file.

  • 1
    Will not work. The configuration file format is very different. You should consider retracting your answer. – AdamKalisz Oct 23 '18 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.