I'd like to use dnsmasq to set up a white list for certain clients on my network.

For instance, I'd like to have these rules for clients in the range -


This way, the only websites accessible from these clients are the ones that are whitelisted. Clients on the network outside of that range should be able to use whatever DNS server they want. How can I do this?


This is what I have in dnsmasq.conf so far:



This has the intended result of denying upstream DNS lookups to all clients on the network. Now what I need is a way to allow certain clients to use upstream DNS instead. I don't think an option like this exists but maybe it will help get my idea across:

use-resolv --source

i.e., if the client's IP address is then use upstream DNS servers. Alternatively, what I was originally looking for was something like this:

no-resolv --source

i.e., if the client's IP address is then don't use upstream servers at all.

If I can't do something like this, then maybe what I need is two separate networks.


This tutorial sounds like what you want. Titled: To Protect and Surf (dnsmasq and Whitelists).

The idea is fairly simple. Isolate machines so that their only DNS server they're aware of is the DNSMasq server. Then add the following lines to DNSMasq's config. file, /etc/dnsmasq.conf:


# Add other name servers here, with domain specs if they are for
# non-public domains.

Once you have this in place the servers pointing to the DNSMasq server will simply not be able to find any DNS results besides the ones in the config. file.

NOTE: This is by no means full proof and can be circumvented pretty easily. But if you're using it to keep children off of other websites, then it's probably enough for the task.


You can setup a system so that its DNS is configured to only send requests to the DNSMasq server through the configuration file, /etc/resolv.conf.

  • How do I "Isolate machines so that their only DNS server they're aware of is the DNSMasq server"? – David Kennedy Nov 7 '13 at 3:42
  • @davidkennedy85 - depends on how your network is setup, but the easiest method would be to edit the /etc/resolv.conf file and add the IP of the dnsmaq server. – slm Nov 7 '13 at 3:58
  • Unfortunately I don't have a way to enforce local policies like that. I need a way to force nameservers at the proxy level, if that makes sense. – David Kennedy Nov 7 '13 at 5:00
  • @davidkennedy85 - can you explain the situation more then? Ultimately the solution, if any, is going to hinge on how you have your environment setup. Try and focus on the computers and how they're accessing the internet. Do they use DHCP? Is there a single computer doing NAT in a home network or is this a business? – slm Nov 7 '13 at 8:22
  • Sorry it took me a while to get back to you, I got distracted. Let's just say I have a wireless hotspot, and I don't want just anyone who jumps on the network to be able to access whatever they want. Certain clients should be able to however. At this point I'm thinking that I need two separate networks unfortunately, which most likely means investing in extra hardware. It would be cool if dnsmasq could handle this but if not then oh well. – David Kennedy Dec 9 '13 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.