Additional DNSMasq Options

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 20:24, 4 May 2020 (edit)
Wrtf (Talk | contribs)
(added man page link)
← Previous diff
Revision as of 21:40, 4 May 2020 (edit) (undo)
Wrtf (Talk | contribs)
(added summaries of the options, links to more info)
Next diff →
Line 3: Line 3:
==DHCP Options== ==DHCP Options==
-* '''DHCP-Authoritative''' should be set when DD-WRT is the only DHCP server on its network segment (the most common setup). When authoritative, the DHCP server will immediately assign new addresses to clients that try to register using IPs from another network (rather than letting their previous lease time run out). ([https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=7335 forum thread])+* '''DHCP-Authoritative''' should be set when DD-WRT is the only DHCP server on its network segment (the most common setup). When authoritative, the DHCP server will immediately assign new addresses to clients that try to register using IPs from another network (rather than letting their previous lease time run out).
 +** See also: ''-dhcp-authoritative'' in the man page, [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=7335 forum thread]
 +* '''RFC4039 Rapid Commit support''' removes a round trip by returning an address lease in response to a DHCPDISCOVER from a client that also supports Rapid Commit.
 +** See also: ''--dhcp-rapid-commit'' in the [http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html man page], [https://tools.ietf.org/html/rfc4039 RFC]
==DNS Options== ==DNS Options==
-* '''Forced DNS redirection''' redirects all DNS requests on port 53 to DD-WRT's internal DNSmasq server, even if those requests were pointed directly at an external DNS server. Note that, as discussed in the forum thread, savvy users might still be able to communicate with external DNS servers on non-53 ports. ([https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=301220 forum thread])+* '''Forced DNS redirection''' redirects all DNS requests on port 53 to DD-WRT's internal DNSmasq server, even if those requests were pointed directly at an external DNS server. Note that, as discussed in the forum thread, savvy users might still be able to communicate with external DNS servers on non-53 ports.
 +** See also: ''[https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=301220 forum thread]
 +* '''Validate DNS Replies (DNSSEC)''' requests and validates DNSSEC records for domains that have them, if supported on your router model.
 +** See also: ''--dnssec'' in the [http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html man page]
 +* '''Check unsigned DNS replies''' also checks that unsigned DNS replies are legitimate (they belong to domains that actually do not publish DNSSEC records).
 +** See also: ''--dnssec-check-unsigned'' in the [http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html man page]
 +* '''No DNS Rebind''' rejects IP address responses in the private IP ranges from upstream (i.e. public) DNS servers.
 +** See also: ''--stop-dns-rebind'' in the [http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html man page], [https://blog.trendmicro.com/trendlabs-security-intelligence/protecting-your-router-against-possibl-dns-rebinding-attacks/ ext link] on security implications
 +* '''Query DNS in Strict Order''' tells DNSmasq to query the upstream servers in the order entered, i.e. 1 first. Otherwise, queries can go to any upstream server.
 +** See also: ''--strict-order'' in the [http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html man page]
 +* '''Add Requestor MAC to DNS Query''' adds the internal requestor's MAC address to the query sent to the upstream DNS server, which could be necessary if the upstream server filters requests by MAC.
 +** See also: ''--add-mac'' in the [http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html man page]
 + 
 + 
currently I (Jackykoning) only know one fun trick that might be useful for some people. currently I (Jackykoning) only know one fun trick that might be useful for some people.
Line 23: Line 39:
* [https://kb.isc.org/docs/isc-dhcp-44-manual-pages-dhcpdconf ISC documentation on DHCP Authoritative] * [https://kb.isc.org/docs/isc-dhcp-44-manual-pages-dhcpdconf ISC documentation on DHCP Authoritative]
* [http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html DNSMASQ man page] * [http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html DNSMASQ man page]
 +* [https://blog.trendmicro.com/trendlabs-security-intelligence/protecting-your-router-against-possibl-dns-rebinding-attacks/ Trend Micro on DNS rebinding attack]
 +* [https://tools.ietf.org/html/rfc4039 RFC 4039] (Rapid Commit)
[[Category:DNS]] [[Category:DNS]]

Revision as of 21:40, 4 May 2020

The "Additional DNSMasq Options" is an optional setting in the tab: Services > Services.

DHCP Options

  • DHCP-Authoritative should be set when DD-WRT is the only DHCP server on its network segment (the most common setup). When authoritative, the DHCP server will immediately assign new addresses to clients that try to register using IPs from another network (rather than letting their previous lease time run out).
    • See also: -dhcp-authoritative in the man page, forum thread
  • RFC4039 Rapid Commit support removes a round trip by returning an address lease in response to a DHCPDISCOVER from a client that also supports Rapid Commit.

DNS Options

  • Forced DNS redirection redirects all DNS requests on port 53 to DD-WRT's internal DNSmasq server, even if those requests were pointed directly at an external DNS server. Note that, as discussed in the forum thread, savvy users might still be able to communicate with external DNS servers on non-53 ports.
  • Validate DNS Replies (DNSSEC) requests and validates DNSSEC records for domains that have them, if supported on your router model.
  • Check unsigned DNS replies also checks that unsigned DNS replies are legitimate (they belong to domains that actually do not publish DNSSEC records).
    • See also: --dnssec-check-unsigned in the man page
  • No DNS Rebind rejects IP address responses in the private IP ranges from upstream (i.e. public) DNS servers.
    • See also: --stop-dns-rebind in the man page, ext link on security implications
  • Query DNS in Strict Order tells DNSmasq to query the upstream servers in the order entered, i.e. 1 first. Otherwise, queries can go to any upstream server.
    • See also: --strict-order in the man page
  • Add Requestor MAC to DNS Query adds the internal requestor's MAC address to the query sent to the upstream DNS server, which could be necessary if the upstream server filters requests by MAC.


currently I (Jackykoning) only know one fun trick that might be useful for some people.

This redirects the stupid babylon search engine to google.

address=/isearch.babylon.com/173.194.66.102

prefix = address=/"url here"(without http:// and without /shit )/"ip here" (not another url!)

External Links