From ddf64aeb8b60312ac45d69b584556074d7ac88dc Mon Sep 17 00:00:00 2001 From: pboy Date: Wed, 20 May 2026 17:56:29 +0200 Subject: [PATCH] Updated dnsmasq doc to f44 --- .../ROOT/pages/administration/dnsmasq.adoc | 55 +++++++++++++------ 1 file changed, 39 insertions(+), 16 deletions(-) diff --git a/modules/ROOT/pages/administration/dnsmasq.adoc b/modules/ROOT/pages/administration/dnsmasq.adoc index 3758c49..2e2f7cb 100644 --- a/modules/ROOT/pages/administration/dnsmasq.adoc +++ b/modules/ROOT/pages/administration/dnsmasq.adoc @@ -10,10 +10,10 @@ Peter Boy; Emmmanuel Seyman [abstract] The Fedora Server Edition recommends using the lightweight dnsmasq program to provide a server and a small to medium-sized local network with DHCP, DDNS and DNS caching services. Fedora Server has already preconfigured it as a NetworkManager plugin to ensure seamless integration of the components. -[NOTE] -==== -**Status:** checked and ready for final review (2026-05-11) -==== +//[NOTE] +//==== +//**Status:** checked and ready for final review (2026-05-11) +//==== == Introduction By default, Fedora Server uses dnsmasq to provide local DNS and DHCP services for private or public subnets. It is preconfigured as a NetworkManager plug-in to ensure seamless integration of the components. @@ -30,20 +30,42 @@ For additional information, see the _Fedora Magazine_ article https://fedoramag == Prerequisites All the necessary interfaces have been installed and fully configured. This includes assigning the correct firewall zones. + +* **Check firewall zones** ++ +You should get something like ++ +[source,] +---- +[…]# firewall-cmd --get-active-zones +FedoraServer (default) + interfaces: ... + + interfaces: ... +---- ++ +Fix the zone assignments if necessary ++ [source,] ---- […]# firewall-cmd --permanent --zone= --change-interface= […]# firewall-cmd --reload ---- + +* **Check auto forwarding** ++ The system should automatically forward between the interfaces. Check the forwarding status and adjust it if necessary. ++ [source,] ---- […]# cat /proc/sys/net/ipv4/ip_forward […]# cat /proc/sys/net/ipv6/conf/default/forwarding ---- ++ In both cases a value of 1 indicates an active forwarding. - ++ Otherwise, enable it immediately and configure it permanently. ++ [source,] ---- […]# echo 1 > /proc/sys/net/ipv4/ip_forward @@ -87,7 +109,7 @@ NetworkManager reads all files in that directory, independantly of the file exte The example here uses 2 interfaces, an external public interface enp1s0 (public.tld) and an internal private interface enp2s0 (internal.lan). You may add any number of additional interfaces by adding corresponding config files as in the examples here. -1. Activate the dnsmasq NetworkManager plugin +1. **Activate the dnsmasq NetworkManager plugin** + [source,] ---- @@ -99,7 +121,7 @@ The example here uses 2 interfaces, an external public interface enp1s0 (public. dns=dnsmasq ---- -2. Configuration of the name resolution (DNS) for the internal private network (internal.lan) +2. **Configuration of the name resolution (DNS) for the internal private network (internal.lan)** + [source,] ---- @@ -133,10 +155,10 @@ Provide an empty host file + [source,] ---- -[…]# touch dnsmasq-.hosts +[…]# touch /etc/dnsmasq-.hosts ---- -3. Configuration of the DHCP service for the internal private network (.lan) +3. **Configuration of the DHCP service for the internal private network (.lan)** + [source,] ---- @@ -172,7 +194,7 @@ Provide an empty host file dhcp-range=tag:,,24h ---- -4. Configuration of the DHCP service for the public network () +4. **Configuration of the DHCP service for the public network ()** + [source,] ---- @@ -208,14 +230,14 @@ Provide an empty host file + There is no DNS configuration for the external interface following, assuming that a official public DNS server is used to resolve all public facing interfaces of the domain public.tld. -5. Test the dnsmasq configuration +5. **Test the dnsmasq configuration** + [source,] ---- […]# dnsmasq --test ---- -6. Adjusting the firewall +6. **Adjusting the firewall** + Allow ports for DHCP and DNS (53) service on the public interface. + @@ -225,21 +247,22 @@ Allow ports for DHCP and DNS (53) service on the public interface. […]# firewall-cmd --zone= --permanent --add-service=dhcp […]# firewall-cmd --zone= --permanent --add-service=dns […]# firewall-cmd --reload - […]# firewall-cmd --list-all + […]# firewall-cmd --list-all --zone= ---- -6. Restart NetworkManager to start dnsmasq +7. **Restart NetworkManager to start dnsmasq** + [source,] ---- […]# systemctl restart NetworkManager […]# ps -ef | grep dnsmasq +dnsmasq 2114 2072 0 08:33 ? 00:00:00 /usr/sbin/dnsmasq --no-resolv ... ---- + NetworkManager should have started __dnsmasq__ shown by the '__ps__' command above. -8. Restart systemd-resolved +8. **Restart systemd-resolved** + [source,] ---- @@ -249,7 +272,7 @@ command above. + The systemd-resolved should recognize the dnsmasq nameserver attached to interfaces as configured. -9. Test the installation +9. **Test the installation** a. Test DHCP in the public using a machine without IP address +