Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| router:dnsmasq [2024/02/13 09:32] – willy | router:dnsmasq [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ===== DNS, DHCP and routing for the internal network ===== | ||
| - | |||
| - | Since your home network is connected **only** to your home server (right?), in order to be able to navigate and use the home network you must configure some services on your home server. | ||
| - | |||
| - | In detail, you will need: | ||
| - | * one DNS server, so that devices in the home network can resolve names to addresses (and filter ads) | ||
| - | * one DHCP server, so provide devices in the home network with automatic configuration | ||
| - | * one default gateway and router: to allow devices in the home network to access stuff on the internet | ||
| - | |||
| - | To achieve the first two steps, i will show you the use of [[https:// | ||
| - | |||
| - | To create a router, you will be using the Linux built-in great nftables tools that today has replaced the older iptables. | ||
| - | |||
| - | ==== Default DNS resolvers ==== | ||
| - | |||
| - | There is a dedicated page to AdBlocking [[router: | ||
| - | |||
| - | You don't want to create a full-fledged DNS resolver, because it would be too onerous on your home network and will not provide much benefit anyway. You want to use good DNS resolvers for you and then cache all your DNS queries from your home network. | ||
| - | |||
| - | I use custom DNS for ad blocking, AdGuard DNS to be precise. There might be better solutions out there, but it just work enough for me. I will show you how to pre-filter all ads with custom blocklists anyway. | ||
| - | |||
| - | You need to populate your **/ | ||
| - | <file - resolv.conf> | ||
| - | |||
| - | </ | ||
| - | # Google DNS | ||
| - | #nameserver 8.8.8.8 | ||
| - | #nameserver 8.8.4.4 | ||
| - | # AdGuard DNS | ||
| - | nameserver 94.140.14.14 | ||
| - | nameserver 94.140.15.15 | ||
| - | </ | ||
| - | |||
| - | this will be immediately active. | ||
| - | |||
| - | ==== DNSMasq ==== | ||
| - | |||
| - | Installing DNSMasq is easy enough, but better enable a couple of specific use flags first: | ||
| - | <code bash> | ||
| - | > echo net-dns/ | ||
| - | </ | ||
| - | |||
| - | **dhcp.tools** is needed to ensure dnsmasq will support DHCP, while **dnssec** will be useful to enable dnssec support on the home network. | ||
| - | |||
| - | Install the tool: | ||
| - | <code bash> | ||
| - | > emerge dnsmasq | ||
| - | </ | ||
| - | |||
| - | All you actually need to do it create a meaningful configuration file, take this one as example: | ||
| - | <file - dnsmasq.conf> | ||
| - | # Here put your home LAN interface | ||
| - | interface=enp0s31f6 | ||
| - | # do not resolve your internal DNS names outside | ||
| - | domain-needed | ||
| - | # Never forward addresses in the non-routed address spaces | ||
| - | bogus-priv | ||
| - | # Enable dnssec support | ||
| - | conf-file=/ | ||
| - | dnssec | ||
| - | dnssec-check-unsigned | ||
| - | # You can add your own ads filters here (only hosts format!) | ||
| - | # | ||
| - | # Use this custom-folder to add more blocklists; | ||
| - | # conf-dir=/ | ||
| - | # DHCP settings for internal network (from 100 to 250, under 100 are fixed ips) | ||
| - | dhcp-range=10.0.0.100, | ||
| - | # Send gateway and DNS values to the DHCP clients | ||
| - | dhcp-option=option: | ||
| - | dhcp-option=option: | ||
| - | # Preassign fixed IPs via DHCP to specific hosts: | ||
| - | # | ||
| - | </ | ||
| - | |||
| - | here i assign a pool od dynamic IP addresses (from 100 to 254) on the 10.0.0.0 subnet. Addresses under 100 can be used for static assignments. For example, i use static IPs for all my OpenWRT Access Points and wired security cameras, and dynamic for all other devices. | ||
| - | |||
| - | To be sure that all devices will use the home server both as DNS server and gateway, you need to set the two above dhcp options. This will not work for devices that use hard-coded DNS servers (like Fire Sticks and Google Chromecasts...) but there is a workaround for those too, and i will show you later on. | ||
| - | |||
| - | Well, this is almost all. Start //dnsmasq// service and make it start on boot: | ||
| - | <code bash> | ||
| - | > rc-update add dnsmasq default | ||
| - | > / | ||
| - | </ | ||
| - | |||
| - | Now you can connect your devices to the home network and they will get an IP address and a full network configuration to go with it. | ||
| - | |||
| - | |||
| - | ==== Hosts file ==== | ||
| - | |||
| - | DNSMasq will use your home server **/ | ||
| - | <file - hosts> | ||
| - | 10.0.0.1 home.mydomain.com | ||
| - | 10.0.0.1 mydomain.com | ||
| - | </ | ||
| - | |||
| - | So that all devices inside your network will be able to reach your internal services like they are from outside, and mobile devices will only require **one** configuration both when they are inside and outside your home network. | ||