Multiple DNS servers listening on different addresses

[Phaquum]

This is what I'm trying to do:

192.168.1.1#53 is normal, unfiltered dnsmasq
192.168.1.2#53 is https-dns-proxy forwarded to a filtered upstream DNS server

Then I can use tags in dnsmasq to assign the appropriate DNS server, depending on whether I want the device to get filtered or unfiltered DNS responses. This DHCP tagging is easy to do.

the relevant snippet of /etc/config/dhcp

config tag 'pihole'
	list dhcp_option '6,192.168.1.2'

config host
	option name 'laptop'
	option dns '1'
	option ip '192.168.1.7'
	option mac 'FF:FF:FF:FF:FF:00'

config host
	option name 'kids-laptop'
	option dns '1'
	option ip '192.168.1.8'
	option mac 'FF:FF:FF:FF:FF:01'
	option tag 'pihole'

I am having a problem, though. When creating an IP alias to put two addresses on my LAN interface, in the modern Linux style, they are both put on the same interface, so dnsmasq listens on both of the addresses:

ip addr show br-lan

44: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether ff:ff:ff:ff:ff:03 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet 192.168.1.2/24 brd 192.168.169.255 scope global secondary br-lan
       valid_lft forever preferred_lft forever

the relevant snippet of /etc/config/networks

config interface 'lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '64'
        option stp '1'
        option ip6hint '00'
        option device 'br-lan'

config device                          
        option name 'br-lan'           
        option type 'bridge'           
        list ports 'eth1.1'            
                                       
config interface 'lan2'                
        option device '@lan'           
        option proto 'static'          
        option ipaddr '192.168.1.2'  
        option netmask '255.255.255.0'

Because both addresses are on the same interface, I can't use notinterface to tell dnsmasq to ignore the second address. There also doesn't seem to be a uci method of setting the dnsmasq option listen-address.

Is there a way to put the secondary IP address on a separate interface, so then I can use notinterface to force dnsmasq to ignore it?

Failing that, is there a uci method of creating files in /tmp/dnsmasq.d/ so I can put a bunch of listen-address lines?

Or, am I on the wrong track, and there is a better way to run two different DNS resolvers?

[_bernd]

How about assign your "service" addresses on lo instead?
To assign multiple addresses on an interface you can also just simple use list ipaddr <IP>/<mask> within the interface stanza (and remove option netmask).

Edit: I got you wrong... You may want an secondary loopback interface or dummy interface. Then you can assign address and create your DNAT rule and exclude that interface for dnsmasq?

[Phaquum]

@_bernd

How about assign your "service" addresses on lo instead?

I'm not sure how having a (locally) routable IP address on lo would work.

@_bernd

or dummy interface

Yes, that is pretty much what I ended up doing, but just recycling an alias of the wan interface.

I got it working, but it will take a bit of explaining:

My cable modem is on the address 192.168.100.1, so in order to be able to access the modems status page I have an IP address 192.168.100.10 assigned as an alias to the wan interface.

I do not care if dnsmasq is listening on wan, and in fact would prefer it to not listen there. To prevent it listening I added to /etc/config/dhcp

list notinterface 'eth0.2'
option nonwildcard '1'

(or just remove option nonwildcard)

Now dnsmasq will not be listening on 192.168.100.10#53, which leaves it available for https-dns-proxy to listen on it:

option bootstrap_dns '1.1.1.1,1.0.0.1'
option resolver_url 'https://filter.dns/dns-query'
option listen_addr '192.168.100.10'
option listen_port '53'

Now I can add my DHCP tag as described in the first post, and assign the 192.168.100.10 as the DNS server for some of my DHCP clients.