blob: c858323d78bdd6762a00e61d32250c05c7ff7ba1 [file] [log] [blame]
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001.TH DNSMASQ 8
2.SH NAME
3dnsmasq \- A lightweight DHCP and caching DNS server.
4.SH SYNOPSIS
5.B dnsmasq
6.I [OPTION]...
7.SH "DESCRIPTION"
8.BR dnsmasq
Simon Kelley34d0a362013-01-02 11:40:56 +00009is a lightweight DNS, TFTP, PXE, router advertisement and DHCP server. It is intended to provide
Simon Kelley5aabfc72007-08-29 11:24:47 +010010coupled DNS and DHCP service to a LAN.
Simon Kelley9e4abcb2004-01-22 19:47:41 +000011.PP
12Dnsmasq accepts DNS queries and either answers them from a small, local,
13cache or forwards them to a real, recursive, DNS server. It loads the
14contents of /etc/hosts so that local hostnames
15which do not appear in the global DNS can be resolved and also answers
Simon Kelleyee415862014-02-11 11:07:22 +000016DNS queries for DHCP configured hosts. It can also act as the
17authoritative DNS server for one or more domains, allowing local names
18to appear in the global DNS. It can be configured to do DNSSEC
19validation.
Simon Kelley9e4abcb2004-01-22 19:47:41 +000020.PP
Simon Kelley73a08a22009-02-05 20:28:08 +000021The dnsmasq DHCP server supports static address assignments and multiple
22networks. It automatically
Simon Kelley3be34542004-09-11 19:12:13 +010023sends a sensible default set of DHCP options, and can be configured to
Simon Kelleyf2621c72007-04-29 19:47:21 +010024send any desired set of DHCP options, including vendor-encapsulated
Simon Kelley1b7ecd12007-02-05 14:57:57 +000025options. It includes a secure, read-only,
Simon Kelley34d0a362013-01-02 11:40:56 +000026TFTP server to allow net/PXE boot of DHCP hosts and also supports BOOTP. The PXE support is full featured, and includes a proxy mode which supplies PXE information to clients whilst DHCP address allocation is done by another server.
Simon Kelley9e4abcb2004-01-22 19:47:41 +000027.PP
Simon Kelley81925ab2013-04-10 11:43:58 +010028The dnsmasq DHCPv6 server provides the same set of features as the
29DHCPv4 server, and in addition, it includes router advertisements and
30a neat feature which allows nameing for clients which use DHCPv4 and
Simon Kelley834f36f2013-04-17 13:52:49 +010031stateless autoconfiguration only for IPv6 configuration. There is support for doing address allocation (both DHCPv6 and RA) from subnets which are dynamically delegated via DHCPv6 prefix delegation.
Simon Kelley34d0a362013-01-02 11:40:56 +000032.PP
33Dnsmasq is coded with small embedded systems in mind. It aims for the smallest possible memory footprint compatible with the supported functions, and allows uneeded functions to be omitted from the compiled binary.
Simon Kelley9e4abcb2004-01-22 19:47:41 +000034.SH OPTIONS
35Note that in general missing parameters are allowed and switch off
Simon Kelley832af0b2007-01-21 20:01:28 +000036functions, for instance "--pid-file" disables writing a PID file. On
Simon Kelley33820b72004-04-03 21:10:00 +010037BSD, unless the GNU getopt library is linked, the long form of the
38options does not work on the command line; it is still recognised in
39the configuration file.
Simon Kelley9e4abcb2004-01-22 19:47:41 +000040.TP
Simon Kelley7622fc02009-06-04 20:32:05 +010041.B --test
42Read and syntax check configuration file(s). Exit with code 0 if all
43is OK, or a non-zero code otherwise. Do not start up dnsmasq.
44.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +000045.B \-h, --no-hosts
46Don't read the hostnames in /etc/hosts.
47.TP
48.B \-H, --addn-hosts=<file>
49Additional hosts file. Read the specified file as well as /etc/hosts. If -h is given, read
Simon Kelleyfd9fa482004-10-21 20:24:00 +010050only the specified file. This option may be repeated for more than one
Simon Kelley7622fc02009-06-04 20:32:05 +010051additional hosts file. If a directory is given, then read all the files contained in that directory.
Simon Kelley9e4abcb2004-01-22 19:47:41 +000052.TP
Simon Kelley3d04f462015-01-31 21:59:13 +000053.B --hostsdir=<path>
54Read all the hosts files contained in the directory. New or changed files
55are read automatically. See --dhcp-hostsdir for details.
56.TP
Simon Kelley832af0b2007-01-21 20:01:28 +000057.B \-E, --expand-hosts
58Add the domain to simple names (without a period) in /etc/hosts
Simon Kelley1f15b812009-10-13 17:49:32 +010059in the same way as for DHCP-derived names. Note that this does not
60apply to domain names in cnames, PTR records, TXT records etc.
Simon Kelley832af0b2007-01-21 20:01:28 +000061.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +000062.B \-T, --local-ttl=<time>
63When replying with information from /etc/hosts or the DHCP leases
64file dnsmasq by default sets the time-to-live field to zero, meaning
Simon Kelleyc72daea2012-01-05 21:33:27 +000065that the requester should not itself cache the information. This is
Simon Kelley9e4abcb2004-01-22 19:47:41 +000066the correct thing to do in almost all situations. This option allows a
67time-to-live (in seconds) to be given for these replies. This will
68reduce the load on the server at the expense of clients using stale
69data under some circumstances.
70.TP
Simon Kelley824af852008-02-12 20:43:05 +000071.B --neg-ttl=<time>
72Negative replies from upstream servers normally contain time-to-live
73information in SOA records which dnsmasq uses for caching. If the
74replies from upstream servers omit this information, dnsmasq does not
75cache the reply. This option gives a default value for time-to-live
76(in seconds) which dnsmasq uses to cache negative replies even in
77the absence of an SOA record.
78.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +010079.B --max-ttl=<time>
80Set a maximum TTL value that will be handed out to clients. The specified
81maximum TTL will be given to clients instead of the true TTL value if it is
82lower. The true TTL value is however kept in the cache to avoid flooding
83the upstream DNS servers.
84.TP
Simon Kelley1d860412012-09-20 20:48:04 +010085.B --max-cache-ttl=<time>
86Set a maximum TTL value for entries in the cache.
87.TP
RinSatsuki28de3872015-01-10 15:22:21 +000088.B --min-cache-ttl=<time>
89Extend short TTL values to the time given when caching them. Note that
90artificially extending TTL values is in general a bad idea, do not do it
91unless you have a good reason, and understand what you are doing.
92Dnsmasq limits the value of this option to one hour, unless recompiled.
93.TP
Simon Kelley333b2ce2013-01-07 21:46:03 +000094.B --auth-ttl=<time>
95Set the TTL value returned in answers from the authoritative server.
96.TP
Simon Kelley3be34542004-09-11 19:12:13 +010097.B \-k, --keep-in-foreground
98Do not go into the background at startup but otherwise run as
Simon Kelley3d8df262005-08-29 12:19:27 +010099normal. This is intended for use when dnsmasq is run under daemontools
100or launchd.
Simon Kelley3be34542004-09-11 19:12:13 +0100101.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000102.B \-d, --no-daemon
103Debug mode: don't fork to the background, don't write a pid file,
104don't change user id, generate a complete cache dump on receipt on
Simon Kelley3be34542004-09-11 19:12:13 +0100105SIGUSR1, log to stderr as well as syslog, don't fork new processes
Simon Kelley83b21982012-11-12 21:07:44 +0000106to handle TCP queries. Note that this option is for use in debugging
107only, to stop dnsmasq daemonising in production, use
108.B -k.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000109.TP
110.B \-q, --log-queries
Simon Kelley25cf5e32015-01-09 15:53:03 +0000111Log the results of DNS queries handled by dnsmasq. Enable a full cache dump on receipt of SIGUSR1. If the argument "extra" is supplied, ie
112.B --log-queries=extra
113then the log has extra information at the start of each line.
114This consists of a serial number which ties together the log lines associated with an individual query, and the IP address of the requestor.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000115.TP
Simon Kelley849a8352006-06-09 21:02:31 +0100116.B \-8, --log-facility=<facility>
117Set the facility to which dnsmasq will send syslog entries, this
Simon Kelleyf2621c72007-04-29 19:47:21 +0100118defaults to DAEMON, and to LOCAL0 when debug mode is in operation. If
Simon Kelley9e038942008-05-30 20:06:34 +0100119the facility given contains at least one '/' character, it is taken to
Simon Kelleyf2621c72007-04-29 19:47:21 +0100120be a filename, and dnsmasq logs to the given file, instead of
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100121syslog. If the facility is '-' then dnsmasq logs to stderr.
122(Errors whilst reading configuration will still go to syslog,
Simon Kelleyf2621c72007-04-29 19:47:21 +0100123but all output from a successful startup, and all output whilst
Simon Kelley5aabfc72007-08-29 11:24:47 +0100124running, will go exclusively to the file.) When logging to a file,
125dnsmasq will close and reopen the file when it receives SIGUSR2. This
126allows the log file to be rotated without stopping dnsmasq.
Simon Kelleyf2621c72007-04-29 19:47:21 +0100127.TP
128.B --log-async[=<lines>]
129Enable asynchronous logging and optionally set the limit on the
130number of lines
131which will be queued by dnsmasq when writing to the syslog is slow.
132Dnsmasq can log asynchronously: this
133allows it to continue functioning without being blocked by syslog, and
134allows syslog to use dnsmasq for DNS queries without risking deadlock.
135If the queue of log-lines becomes full, dnsmasq will log the
136overflow, and the number of messages lost. The default queue length is
1375, a sane value would be 5-25, and a maximum limit of 100 is imposed.
Simon Kelley849a8352006-06-09 21:02:31 +0100138.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000139.B \-x, --pid-file=<path>
140Specify an alternate path for dnsmasq to record its process-id in. Normally /var/run/dnsmasq.pid.
141.TP
142.B \-u, --user=<username>
143Specify the userid to which dnsmasq will change after startup. Dnsmasq must normally be started as root, but it will drop root
Simon Kelleyb8187c82005-11-26 21:46:27 +0000144privileges after startup by changing id to another user. Normally this user is "nobody" but that
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000145can be over-ridden with this switch.
146.TP
147.B \-g, --group=<groupname>
148Specify the group which dnsmasq will run
149as. The defaults to "dip", if available, to facilitate access to
150/etc/ppp/resolv.conf which is not normally world readable.
151.TP
152.B \-v, --version
153Print the version number.
154.TP
155.B \-p, --port=<port>
Simon Kelley824af852008-02-12 20:43:05 +0000156Listen on <port> instead of the standard DNS port (53). Setting this
157to zero completely disables DNS function, leaving only DHCP and/or TFTP.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000158.TP
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100159.B \-P, --edns-packet-max=<size>
160Specify the largest EDNS.0 UDP packet which is supported by the DNS
Simon Kelley316e2732010-01-22 20:16:09 +0000161forwarder. Defaults to 4096, which is the RFC5625-recommended size.
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100162.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000163.B \-Q, --query-port=<query_port>
Simon Kelley1a6bca82008-07-11 11:11:42 +0100164Send outbound DNS queries from, and listen for their replies on, the
165specific UDP port <query_port> instead of using random ports. NOTE
166that using this option will make dnsmasq less secure against DNS
167spoofing attacks but it may be faster and use less resources. Setting this option
168to zero makes dnsmasq use a single port allocated to it by the
169OS: this was the default behaviour in versions prior to 2.43.
170.TP
171.B --min-port=<port>
172Do not use ports less than that given as source for outbound DNS
173queries. Dnsmasq picks random ports as source for outbound queries:
174when this option is given, the ports used will always to larger
175than that specified. Useful for systems behind firewalls.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000176.TP
177.B \-i, --interface=<interface name>
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100178Listen only on the specified interface(s). Dnsmasq automatically adds
179the loopback (local) interface to the list of interfaces to use when
180the
181.B \--interface
182option is used. If no
183.B \--interface
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000184or
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100185.B \--listen-address
186options are given dnsmasq listens on all available interfaces except any
187given in
188.B \--except-interface
Simon Kelley309331f2006-04-22 15:05:01 +0100189options. IP alias interfaces (eg "eth1:0") cannot be used with
Simon Kelley8a911cc2004-03-16 18:35:52 +0000190.B --interface
191or
192.B --except-interface
Simon Kelley49333cb2013-03-15 20:30:51 +0000193options, use --listen-address instead. A simple wildcard, consisting
194of a trailing '*', can be used in
195.B \--interface
196and
197.B \--except-interface
198options.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000199.TP
200.B \-I, --except-interface=<interface name>
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100201Do not listen on the specified interface. Note that the order of
202.B \--listen-address
203.B --interface
204and
205.B --except-interface
206options does not matter and that
207.B --except-interface
208options always override the others.
Simon Kelley34d0a362013-01-02 11:40:56 +0000209.TP
210.B --auth-server=<domain>,<interface>|<ip-address>
Simon Kelley81925ab2013-04-10 11:43:58 +0100211Enable DNS authoritative mode for queries arriving at an interface or address. Note that the interface or address
Simon Kelley34d0a362013-01-02 11:40:56 +0000212need not be mentioned in
213.B --interface
214or
215.B --listen-address
216configuration, indeed
217.B --auth-server
Simon Kelleyf25e6c62013-11-17 12:23:42 +0000218will overide these and provide a different DNS service on the
219specified interface. The <domain> is the "glue record". It should
220resolve in the global DNS to a A and/or AAAA record which points to
221the address dnsmasq is listening on. When an interface is specified,
222it may be qualified with "/4" or "/6" to specify only the IPv4 or IPv6
223addresses associated with the interface.
Simon Kelleyc8a80482014-03-05 14:29:54 +0000224.TP
225.B --local-service
226Accept DNS queries only from hosts whose address is on a local subnet,
227ie a subnet for which an interface exists on the server. This option
228only has effect is there are no --interface --except-interface,
229--listen-address or --auth-server options. It is intended to be set as
230a default on installation, to allow unconfigured installations to be
231useful but also safe from being used for DNS amplification attacks.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000232.TP
Simon Kelley3d8df262005-08-29 12:19:27 +0100233.B \-2, --no-dhcp-interface=<interface name>
Simon Kelley832af0b2007-01-21 20:01:28 +0000234Do not provide DHCP or TFTP on the specified interface, but do provide DNS service.
Simon Kelley3d8df262005-08-29 12:19:27 +0100235.TP
Simon Kelley44a2a312004-03-10 20:04:35 +0000236.B \-a, --listen-address=<ipaddr>
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100237Listen on the given IP address(es). Both
238.B \--interface
239and
240.B \--listen-address
241options may be given, in which case the set of both interfaces and
242addresses is used. Note that if no
243.B \--interface
244option is given, but
245.B \--listen-address
246is, dnsmasq will not automatically listen on the loopback
247interface. To achieve this, its IP address, 127.0.0.1, must be
248explicitly given as a
249.B \--listen-address
250option.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000251.TP
Simon Kelley44a2a312004-03-10 20:04:35 +0000252.B \-z, --bind-interfaces
253On systems which support it, dnsmasq binds the wildcard address,
254even when it is listening on only some interfaces. It then discards
255requests that it shouldn't reply to. This has the advantage of
256working even when interfaces come and go and change address. This
257option forces dnsmasq to really bind only the interfaces it is
258listening on. About the only time when this is useful is when
Simon Kelleyf6b7dc42005-01-23 12:06:08 +0000259running another nameserver (or another instance of dnsmasq) on the
Simon Kelley309331f2006-04-22 15:05:01 +0100260same machine. Setting this option also enables multiple instances of
Simon Kelleyf6b7dc42005-01-23 12:06:08 +0000261dnsmasq which provide DHCP service to run in the same machine.
262.TP
Simon Kelley54dd3932012-06-20 11:23:38 +0100263.B --bind-dynamic
264Enable a network mode which is a hybrid between
265.B --bind-interfaces
Simon Kelleya2ce6fc2012-08-06 20:05:48 +0100266and the default. Dnsmasq binds the address of individual interfaces,
Simon Kelley54dd3932012-06-20 11:23:38 +0100267allowing multiple dnsmasq instances, but if new interfaces or
268addresses appear, it automatically listens on those (subject to any
269access-control configuration). This makes dynamically created
270interfaces work in the same way as the default. Implementing this
Simon Kelleya2ce6fc2012-08-06 20:05:48 +0100271option requires non-standard networking APIs and it is only available
Simon Kelley05ff1ed2012-06-26 16:58:12 +0100272under Linux. On other platforms it falls-back to --bind-interfaces mode.
Simon Kelley54dd3932012-06-20 11:23:38 +0100273.TP
Simon Kelleyf6b7dc42005-01-23 12:06:08 +0000274.B \-y, --localise-queries
275Return answers to DNS queries from /etc/hosts which depend on the interface over which the query was
Simon Kelleyb8187c82005-11-26 21:46:27 +0000276received. If a name in /etc/hosts has more than one address associated with
Simon Kelleyf6b7dc42005-01-23 12:06:08 +0000277it, and at least one of those addresses is on the same subnet as the
278interface to which the query was sent, then return only the
279address(es) on that subnet. This allows for a server to have multiple
280addresses in /etc/hosts corresponding to each of its interfaces, and
281hosts will get the correct address based on which network they are
282attached to. Currently this facility is limited to IPv4.
Simon Kelley44a2a312004-03-10 20:04:35 +0000283.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000284.B \-b, --bogus-priv
285Bogus private reverse lookups. All reverse lookups for private IP ranges (ie 192.168.x.x, etc)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100286which are not found in /etc/hosts or the DHCP leases file are answered
287with "no such domain" rather than being forwarded upstream.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000288.TP
Simon Kelley73a08a22009-02-05 20:28:08 +0000289.B \-V, --alias=[<old-ip>]|[<start-ip>-<end-ip>],<new-ip>[,<mask>]
Simon Kelley1cff1662004-03-12 08:12:58 +0000290Modify IPv4 addresses returned from upstream nameservers; old-ip is
291replaced by new-ip. If the optional mask is given then any address
292which matches the masked old-ip will be re-written. So, for instance
293.B --alias=1.2.3.0,6.7.8.0,255.255.255.0
294will map 1.2.3.56 to 6.7.8.56 and 1.2.3.67 to 6.7.8.67. This is what
Simon Kelley73a08a22009-02-05 20:28:08 +0000295Cisco PIX routers call "DNS doctoring". If the old IP is given as
296range, then only addresses in the range, rather than a whole subnet,
297are re-written. So
298.B --alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
299maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40
Simon Kelley1cff1662004-03-12 08:12:58 +0000300.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000301.B \-B, --bogus-nxdomain=<ipaddr>
302Transform replies which contain the IP address given into "No such
303domain" replies. This is intended to counteract a devious move made by
Simon Kelleyb8187c82005-11-26 21:46:27 +0000304Verisign in September 2003 when they started returning the address of
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000305an advertising web page in response to queries for unregistered names,
306instead of the correct NXDOMAIN response. This option tells dnsmasq to
307fake the correct response when it sees this behaviour. As at Sept 2003
Simon Kelleyb8187c82005-11-26 21:46:27 +0000308the IP address being returned by Verisign is 64.94.110.11
Glen Huang32fc6db2014-12-27 15:28:12 +0000309.TP
310.B \-B, --ignore-address=<ipaddr>
311Ignore replies to A-record queries which include the specified address.
312No error is generated, dnsmasq simply continues to listen for another reply.
313This is useful to defeat blocking strategies which rely on quickly supplying a
314forged answer to a DNS request for certain domain, before the correct answer can arrive.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000315.TP
316.B \-f, --filterwin2k
317Later versions of windows make periodic DNS requests which don't get sensible answers from
318the public DNS and can cause problems by triggering dial-on-demand links. This flag turns on an option
319to filter such requests. The requests blocked are for records of types SOA and SRV, and type ANY where the
320requested name has underscores, to catch LDAP requests.
321.TP
322.B \-r, --resolv-file=<file>
323Read the IP addresses of the upstream nameservers from <file>, instead of
324/etc/resolv.conf. For the format of this file see
Simon Kelley7de060b2011-08-26 17:24:52 +0100325.BR resolv.conf (5).
326The only lines relevant to dnsmasq are nameserver ones. Dnsmasq can
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000327be told to poll more than one resolv.conf file, the first file name specified
328overrides the default, subsequent ones add to the list. This is only
329allowed when polling; the file with the currently latest modification
330time is the one used.
331.TP
332.B \-R, --no-resolv
333Don't read /etc/resolv.conf. Get upstream servers only from the command
Simon Kelleyb49644f2004-01-30 21:36:24 +0000334line or the dnsmasq configuration file.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000335.TP
Simon Kelleyad094272012-08-10 17:10:54 +0100336.B \-1, --enable-dbus[=<service-name>]
Simon Kelley3d8df262005-08-29 12:19:27 +0100337Allow dnsmasq configuration to be updated via DBus method calls. The
338configuration which can be changed is upstream DNS servers (and
Simon Kelleyb8187c82005-11-26 21:46:27 +0000339corresponding domains) and cache clear. Requires that dnsmasq has
Simon Kelleyad094272012-08-10 17:10:54 +0100340been built with DBus support. If the service name is given, dnsmasq
341provides service at that name, rather than the default which is
342.B uk.org.thekelleys.dnsmasq
Simon Kelley3d8df262005-08-29 12:19:27 +0100343.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000344.B \-o, --strict-order
345By default, dnsmasq will send queries to any of the upstream servers
Simon Kelley824af852008-02-12 20:43:05 +0000346it knows about and tries to favour servers that are known to
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000347be up. Setting this flag forces dnsmasq to try each query with each
348server strictly in the order they appear in /etc/resolv.conf
349.TP
Simon Kelley824af852008-02-12 20:43:05 +0000350.B --all-servers
351By default, when dnsmasq has more than one upstream server available,
352it will send queries to just one server. Setting this flag forces
353dnsmasq to send all queries to all available servers. The reply from
Simon Kelleyc72daea2012-01-05 21:33:27 +0000354the server which answers first will be returned to the original requester.
Simon Kelley824af852008-02-12 20:43:05 +0000355.TP
Simon Kelleyb5ea1cc2014-07-29 16:34:14 +0100356.B --dns-loop-detect
357Enable code to detect DNS forwarding loops; ie the situation where a query sent to one
358of the upstream server eventually returns as a new query to the dnsmasq instance. The
359process works by generating TXT queries of the form <hex>.test and sending them to
360each upstream server. The hex is a UID which encodes the instance of dnsmasq sending the query
361and the upstream server to which it was sent. If the query returns to the server which sent it, then
362the upstream server through which it was sent is disabled and this event is logged. Each time the
363set of upstream servers changes, the test is re-run on all of them, including ones which
364were previously disabled.
365.TP
Simon Kelley824af852008-02-12 20:43:05 +0000366.B --stop-dns-rebind
367Reject (and log) addresses from upstream nameservers which are in the
368private IP ranges. This blocks an attack where a browser behind a
369firewall is used to probe machines on the local network.
370.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100371.B --rebind-localhost-ok
372Exempt 127.0.0.0/8 from rebinding checks. This address range is
373returned by realtime black hole servers, so blocking it may disable
374these services.
375.TP
376.B --rebind-domain-ok=[<domain>]|[[/<domain>/[<domain>/]
377Do not detect and block dns-rebind on queries to these domains. The
378argument may be either a single domain, or multiple domains surrounded
379by '/', like the --server syntax, eg.
380.B --rebind-domain-ok=/domain1/domain2/domain3/
381.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000382.B \-n, --no-poll
383Don't poll /etc/resolv.conf for changes.
384.TP
Simon Kelley16972692006-10-16 20:04:18 +0100385.B --clear-on-reload
Simon Kelleyd9fb0be2013-07-25 21:47:17 +0100386Whenever /etc/resolv.conf is re-read or the upstream servers are set
387via DBus, clear the DNS cache.
Simon Kelley16972692006-10-16 20:04:18 +0100388This is useful when new nameservers may have different
389data than that held in cache.
390.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000391.B \-D, --domain-needed
Simon Kelley7de060b2011-08-26 17:24:52 +0100392Tells dnsmasq to never forward A or AAAA queries for plain names, without dots
Simon Kelley3d8df262005-08-29 12:19:27 +0100393or domain parts, to upstream nameservers. If the name is not known
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000394from /etc/hosts or DHCP then a "not found" answer is returned.
395.TP
Simon Kelley824af852008-02-12 20:43:05 +0000396.B \-S, --local, --server=[/[<domain>]/[domain/]][<ipaddr>[#<port>][@<source-ip>|<interface>[#<port>]]
Simon Kelley5aabfc72007-08-29 11:24:47 +0100397Specify IP address of upstream servers directly. Setting this flag does
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000398not suppress reading of /etc/resolv.conf, use -R to do that. If one or
399more
400optional domains are given, that server is used only for those domains
401and they are queried only using the specified server. This is
402intended for private nameservers: if you have a nameserver on your
403network which deals with names of the form
404xxx.internal.thekelleys.org.uk at 192.168.1.1 then giving the flag
Simon Kelleyb8187c82005-11-26 21:46:27 +0000405.B -S /internal.thekelleys.org.uk/192.168.1.1
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000406will send all queries for
407internal machines to that nameserver, everything else will go to the
408servers in /etc/resolv.conf. An empty domain specification,
409.B //
410has the special meaning of "unqualified names only" ie names without any
411dots in them. A non-standard port may be specified as
412part of the IP
413address using a # character.
414More than one -S flag is allowed, with
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100415repeated domain or ipaddr parts as required.
416
417More specific domains take precendence over less specific domains, so:
418.B --server=/google.com/1.2.3.4
419.B --server=/www.google.com/2.3.4.5
420will send queries for *.google.com to 1.2.3.4, except *www.google.com,
421which will go to 2.3.4.5
422
423The special server address '#' means, "use the standard servers", so
424.B --server=/google.com/1.2.3.4
425.B --server=/www.google.com/#
426will send queries for *.google.com to 1.2.3.4, except *www.google.com which will
427be forwarded as usual.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000428
429Also permitted is a -S
430flag which gives a domain but no IP address; this tells dnsmasq that
431a domain is local and it may answer queries from /etc/hosts or DHCP
432but should never forward queries on that domain to any upstream
433servers.
434.B local
435is a synonym for
436.B server
437to make configuration files clearer in this case.
438
Simon Kelley7de060b2011-08-26 17:24:52 +0100439IPv6 addresses may include a %interface scope-id, eg
440fe80::202:a412:4512:7bbf%eth0.
441
Simon Kelley824af852008-02-12 20:43:05 +0000442The optional string after the @ character tells
443dnsmasq how to set the source of the queries to this
444nameserver. It should be an ip-address, which should belong to the machine on which
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000445dnsmasq is running otherwise this server line will be logged and then
Simon Kelley824af852008-02-12 20:43:05 +0000446ignored, or an interface name. If an interface name is given, then
447queries to the server will be forced via that interface; if an
448ip-address is given then the source address of the queries will be set
449to that address.
450The query-port flag is ignored for any servers which have a
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000451source address specified but the port may be specified directly as
Simon Kelley824af852008-02-12 20:43:05 +0000452part of the source address. Forcing queries to an interface is not
453implemented on all platforms supported by dnsmasq.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000454.TP
Simon Kelleyde73a492014-02-17 21:43:27 +0000455.B --rev-server=<ip-address>/<prefix-len>,<ipaddr>[#<port>][@<source-ip>|<interface>[#<port>]]
456This is functionally the same as
457.B --server,
458but provides some syntactic sugar to make specifying address-to-name queries easier. For example
459.B --rev-server=1.2.3.0/24,192.168.0.1
460is exactly equivalent to
461.B --server=/3.2.1.in-addr.arpa/192.168.0.1
462.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000463.B \-A, --address=/<domain>/[domain/]<ipaddr>
464Specify an IP address to return for any host in the given domains.
465Queries in the domains are never forwarded and always replied to
466with the specified IP address which may be IPv4 or IPv6. To give
467both IPv4 and IPv6 addresses for a domain, use repeated -A flags.
468Note that /etc/hosts and DHCP leases override this for individual
469names. A common use of this is to redirect the entire doubleclick.net
Simon Kelleya2226412004-05-13 20:27:08 +0100470domain to some friendly local web server to avoid banner ads. The
471domain specification works in the same was as for --server, with the
472additional facility that /#/ matches any domain. Thus
473--address=/#/1.2.3.4 will always return 1.2.3.4 for any query not
474answered from /etc/hosts or DHCP and not sent to an upstream
475nameserver by a more specific --server directive.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000476.TP
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000477.B --ipset=/<domain>/[domain/]<ipset>[,<ipset>]
478Places the resolved IP addresses of queries for the specified domains
479in the specified netfilter ip sets. Domains and subdomains are matched
480in the same way as --address. These ip sets must already exist. See
481ipset(8) for more details.
482.TP
Simon Kelleyf6b7dc42005-01-23 12:06:08 +0000483.B \-m, --mx-host=<mx name>[[,<hostname>],<preference>]
Simon Kelleyde379512004-06-22 20:23:33 +0100484Return an MX record named <mx name> pointing to the given hostname (if
485given), or
486the host specified in the --mx-target switch
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000487or, if that switch is not given, the host on which dnsmasq
Simon Kelleyf6b7dc42005-01-23 12:06:08 +0000488is running. The default is useful for directing mail from systems on a LAN
489to a central server. The preference value is optional, and defaults to
4901 if not given. More than one MX record may be given for a host.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000491.TP
492.B \-t, --mx-target=<hostname>
Simon Kelleyf6b7dc42005-01-23 12:06:08 +0000493Specify the default target for the MX record returned by dnsmasq. See
494--mx-host. If --mx-target is given, but not --mx-host, then dnsmasq
495returns a MX record containing the MX target for MX queries on the
496hostname of the machine on which dnsmasq is running.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000497.TP
498.B \-e, --selfmx
499Return an MX record pointing to itself for each local
500machine. Local machines are those in /etc/hosts or with DHCP leases.
501.TP
502.B \-L, --localmx
503Return an MX record pointing to the host given by mx-target (or the
504machine on which dnsmasq is running) for each
505local machine. Local machines are those in /etc/hosts or with DHCP
506leases.
507.TP
Simon Kelleyf6b7dc42005-01-23 12:06:08 +0000508.B \-W, --srv-host=<_service>.<_prot>.[<domain>],[<target>[,<port>[,<priority>[,<weight>]]]]
509Return a SRV DNS record. See RFC2782 for details. If not supplied, the
510domain defaults to that given by
511.B --domain.
512The default for the target domain is empty, and the default for port
513is one and the defaults for
514weight and priority are zero. Be careful if transposing data from BIND
515zone files: the port, weight and priority numbers are in a different
516order. More than one SRV record for a given service/domain is allowed,
Simon Kelley3d8df262005-08-29 12:19:27 +0100517all that match are returned.
Simon Kelleyf6b7dc42005-01-23 12:06:08 +0000518.TP
Simon Kelleye46164e2012-04-16 16:39:38 +0100519.B --host-record=<name>[,<name>....][<IPv4-address>],[<IPv6-address>]
Simon Kelleye759d422012-03-16 13:18:57 +0000520Add A, AAAA and PTR records to the DNS. This adds one or more names to
521the DNS with associated IPv4 (A) and IPv6 (AAAA) records. A name may
522appear in more than one
523.B host-record
524and therefore be assigned more than one address. Only the first
525address creates a PTR record linking the address to the name. This is
526the same rule as is used reading hosts-files.
527.B host-record
528options are considered to be read before host-files, so a name
529appearing there inhibits PTR-record creation if it appears in
Simon Kelleye46164e2012-04-16 16:39:38 +0100530hosts-file also. Unlike hosts-files, names are not expanded, even when
Simon Kelleye759d422012-03-16 13:18:57 +0000531.B expand-hosts
532is in effect. Short and long names may appear in the same
Simon Kelleye46164e2012-04-16 16:39:38 +0100533.B host-record,
534eg.
535.B --host-record=laptop,laptop.thekelleys.org,192.168.0.1,1234::100
Simon Kelleye759d422012-03-16 13:18:57 +0000536.TP
Simon Kelley0a852542005-03-23 20:28:59 +0000537.B \-Y, --txt-record=<name>[[,<text>],<text>]
538Return a TXT DNS record. The value of TXT record is a set of strings,
Simon Kelley28866e92011-02-14 20:19:14 +0000539so any number may be included, delimited by commas; use quotes to put
540commas into a string. Note that the maximum length of a single string
541is 255 characters, longer strings are split into 255 character chunks.
Simon Kelley0a852542005-03-23 20:28:59 +0000542.TP
Simon Kelley832af0b2007-01-21 20:01:28 +0000543.B --ptr-record=<name>[,<target>]
544Return a PTR DNS record.
545.TP
Simon Kelley1a6bca82008-07-11 11:11:42 +0100546.B --naptr-record=<name>,<order>,<preference>,<flags>,<service>,<regexp>[,<replacement>]
547Return an NAPTR DNS record, as specified in RFC3403.
548.TP
Simon Kelley9009d742008-11-14 20:04:27 +0000549.B --cname=<cname>,<target>
550Return a CNAME record which indicates that <cname> is really
551<target>. There are significant limitations on the target; it must be a
552DNS name which is known to dnsmasq from /etc/hosts (or additional
Simon Kelleyd56a6042013-10-11 14:39:03 +0100553hosts files), from DHCP, from --interface-name or from another
Simon Kelley611ebc52012-07-16 16:23:46 +0100554.B --cname.
555If the target does not satisfy this
Simon Kelley9009d742008-11-14 20:04:27 +0000556criteria, the whole cname is ignored. The cname must be unique, but it
557is permissable to have more than one cname pointing to the same target.
558.TP
Simon Kelley9f7f3b12012-05-28 21:39:57 +0100559.B --dns-rr=<name>,<RR-number>,[<hex data>]
560Return an arbitrary DNS Resource Record. The number is the type of the
561record (which is always in the C_IN class). The value of the record is
Simon Kelleya2ce6fc2012-08-06 20:05:48 +0100562given by the hex data, which may be of the form 01:23:45 or 01 23 45 or
Simon Kelley9f7f3b12012-05-28 21:39:57 +0100563012345 or any mixture of these.
564.TP
Simon Kelleyf7029f52013-11-21 15:09:09 +0000565.B --interface-name=<name>,<interface>[/4|/6]
Simon Kelleyf2621c72007-04-29 19:47:21 +0100566Return a DNS record associating the name with the primary address on
Simon Kelleyf7029f52013-11-21 15:09:09 +0000567the given interface. This flag specifies an A or AAAA record for the given
Simon Kelleyf2621c72007-04-29 19:47:21 +0100568name in the same way as an /etc/hosts line, except that the address is
Simon Kelleyf7029f52013-11-21 15:09:09 +0000569not constant, but taken from the given interface. The interface may be
570followed by "/4" or "/6" to specify that only IPv4 or IPv6 addresses
571of the interface should be used. If the interface is
Simon Kelley9e038942008-05-30 20:06:34 +0100572down, not configured or non-existent, an empty record is returned. The
Simon Kelleyf2621c72007-04-29 19:47:21 +0100573matching PTR record is also created, mapping the interface address to
574the name. More than one name may be associated with an interface
575address by repeating the flag; in that case the first instance is used
576for the reverse address-to-name mapping.
577.TP
Simon Kelley48fd1c42013-04-25 09:49:38 +0100578.B --synth-domain=<domain>,<address range>[,<prefix>]
Simon Kelley2bb73af2013-04-24 17:38:19 +0100579Create artificial A/AAAA and PTR records for an address range. The
580records use the address, with periods (or colons for IPv6) replaced
581with dashes.
582
583An example should make this clearer.
Simon Kelley48fd1c42013-04-25 09:49:38 +0100584.B --synth-domain=thekelleys.org.uk,192.168.0.0/24,internal-
585will result in a query for internal-192-168-0-56.thekelleys.org.uk returning
586192.168.0.56 and a reverse query vice versa. The same applies to IPv6,
587but IPv6 addresses may start with '::'
588but DNS labels may not start with '-' so in this case if no prefix is
589configured a zero is added in front of the label. ::1 becomes 0--1.
Simon Kelley2bb73af2013-04-24 17:38:19 +0100590
591The address range can be of the form
592<ip address>,<ip address> or <ip address>/<netmask>
593.TP
Simon Kelley28866e92011-02-14 20:19:14 +0000594.B --add-mac
595Add the MAC address of the requestor to DNS queries which are
596forwarded upstream. This may be used to DNS filtering by the upstream
597server. The MAC address can only be added if the requestor is on the same
598subnet as the dnsmasq server. Note that the mechanism used to achieve this (an EDNS0 option)
599is not yet standardised, so this should be considered
600experimental. Also note that exposing MAC addresses in this way may
Simon Kelleyed4c0762013-10-08 20:46:34 +0100601have security and privacy implications. The warning about caching
602given for --add-subnet applies to --add-mac too.
603.TP
604.B --add-subnet[[=<IPv4 prefix length>],<IPv6 prefix length>]
605Add the subnet address of the requestor to the DNS queries which are
606forwarded upstream. The amount of the address forwarded depends on the
607prefix length parameter: 32 (128 for IPv6) forwards the whole address,
608zero forwards none of it but still marks the request so that no
609upstream nameserver will add client address information either. The
610default is zero for both IPv4 and IPv6. Note that upstream nameservers
611may be configured to return different results based on this
612information, but the dnsmasq cache does not take account. If a dnsmasq
613instance is configured such that different results may be encountered,
614caching should be disabled.
Simon Kelley28866e92011-02-14 20:19:14 +0000615.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000616.B \-c, --cache-size=<cachesize>
617Set the size of dnsmasq's cache. The default is 150 names. Setting the cache size to zero disables caching.
618.TP
619.B \-N, --no-negcache
620Disable negative caching. Negative caching allows dnsmasq to remember
621"no such domain" answers from upstream nameservers and answer
Simon Kelley5aabfc72007-08-29 11:24:47 +0100622identical queries without forwarding them again.
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000623.TP
Simon Kelley16972692006-10-16 20:04:18 +0100624.B \-0, --dns-forward-max=<queries>
625Set the maximum number of concurrent DNS queries. The default value is
626150, which should be fine for most setups. The only known situation
627where this needs to be increased is when using web-server log file
628resolvers, which can generate large numbers of concurrent queries.
Simon Kelley208b65c2006-08-05 21:41:37 +0100629.TP
Simon Kelley70b4a812014-01-27 22:38:48 +0000630.B --dnssec
631Validate DNS replies and cache DNSSEC data. When forwarding DNS queries, dnsmasq requests the
632DNSSEC records needed to validate the replies. The replies are validated and the result returned as
633the Authenticated Data bit in the DNS packet. In addition the DNSSEC records are stored in the cache, making
634validation by clients more efficient. Note that validation by clients is the most secure DNSSEC mode, but for
635clients unable to do validation, use of the AD bit set by dnsmasq is useful, provided that the network between
636the dnsmasq server and the client is trusted. Dnsmasq must be compiled with HAVE_DNSSEC enabled, and DNSSEC
637trust anchors provided, see
Simon Kelleyee415862014-02-11 11:07:22 +0000638.B --trust-anchor.
Simon Kelleyd588ab52014-03-02 14:30:05 +0000639Because the DNSSEC validation process uses the cache, it is not
640permitted to reduce the cache size below the default when DNSSEC is
641enabled. The nameservers upstream of dnsmasq must be DNSSEC-capable,
642ie capable of returning DNSSEC records with data. If they are not,
643then dnsmasq will not be able to determine the trusted status of
644answers. In the default mode, this menas that all replies will be
645marked as untrusted. If
646.B --dnssec-check-unsigned
647is set and the upstream servers don't support DNSSEC, then DNS service will be entirely broken.
Simon Kelley70b4a812014-01-27 22:38:48 +0000648.TP
Simon Kelleyee415862014-02-11 11:07:22 +0000649.B --trust-anchor=[<class>],<domain>,<key-tag>,<algorithm>,<digest-type>,<digest>
650Provide DS records to act a trust anchors for DNSSEC
651validation. Typically these will be the DS record(s) for Zone Signing
652key(s) of the root zone,
653but trust anchors for limited domains are also possible. The current
654root-zone trust anchors may be donwloaded from https://data.iana.org/root-anchors/root-anchors.xml
Simon Kelley70b4a812014-01-27 22:38:48 +0000655.TP
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000656.B --dnssec-check-unsigned
657As a default, dnsmasq does not check that unsigned DNS replies are
658legitimate: they are assumed to be valid and passed on (without the
659"authentic data" bit set, of course). This does not protect against an
660attacker forging unsigned replies for signed DNS zones, but it is
661fast. If this flag is set, dnsmasq will check the zones of unsigned
662replies, to ensure that unsigned replies are allowed in those
Simon Kelleyd588ab52014-03-02 14:30:05 +0000663zones. The cost of this is more upstream queries and slower
664performance. See also the warning about upstream servers in the
665section on
666.B --dnssec
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000667.TP
Simon Kelleye98bd522014-03-28 20:41:23 +0000668.B --dnssec-no-timecheck
669DNSSEC signatures are only valid for specified time windows, and should be rejected outside those windows. This generates an
670interesting chicken-and-egg problem for machines which don't have a hardware real time clock. For these machines to determine the correct
671time typically requires use of NTP and therefore DNS, but validating DNS requires that the correct time is already known. Setting this flag
672removes the time-window checks (but not other DNSSEC validation.) only until the dnsmasq process receives SIGHUP. The intention is
673that dnsmasq should be started with this flag when the platform determines that reliable time is not currently available. As soon as
674reliable time is established, a SIGHUP should be sent to dnsmasq, which enables time checking, and purges the cache of DNS records
675which have not been throughly checked.
676.TP
Simon Kelley28866e92011-02-14 20:19:14 +0000677.B --proxy-dnssec
Simon Kelley70b4a812014-01-27 22:38:48 +0000678Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients and cache it. This is an
679alternative to having dnsmasq validate DNSSEC, but it depends on the security of the network between
680dnsmasq and the upstream servers, and the trustworthiness of the upstream servers.
681.TP
682.B --dnssec-debug
683Set debugging mode for the DNSSEC validation, set the Checking Disabled bit on upstream queries,
Simon Kelleyee415862014-02-11 11:07:22 +0000684and don't convert replies which do not validate to responses with
685a return code of SERVFAIL. Note that
686setting this may affect DNS behaviour in bad ways, it is not an
687extra-logging flag and should not be set in production.
Simon Kelley28866e92011-02-14 20:19:14 +0000688.TP
Simon Kelleybaa80ae2013-05-29 16:32:07 +0100689.B --auth-zone=<domain>[,<subnet>[/<prefix length>][,<subnet>[/<prefix length>].....]]
Simon Kelley34d0a362013-01-02 11:40:56 +0000690Define a DNS zone for which dnsmasq acts as authoritative server. Locally defined DNS records which are in the domain
Simon Kelleyc50f25a2013-11-21 11:29:27 +0000691will be served. If subnet(s) are given, A and AAAA records must be in one of the
692specified subnets.
693
694As alternative to directly specifying the subnets, it's possible to
Simon Kelley376d48c2013-11-13 13:04:30 +0000695give the name of an interface, in which case the subnets implied by
696that interface's configured addresses and netmask/prefix-length are
697used; this is useful when using constructed DHCP ranges as the actual
698address is dynamic and not known when configuring dnsmasq. The
699interface addresses may be confined to only IPv6 addresses using
700<interface>/6 or to only IPv4 using <interface>/4. This is useful when
701an interface has dynamically determined global IPv6 addresses which should
702appear in the zone, but RFC1918 IPv4 addresses which should not.
703Interface-name and address-literal subnet specifications may be used
704freely in the same --auth-zone declaration.
705
706The subnet(s) are also used to define in-addr.arpa and
Lutz Preßler1d7e0a32014-04-07 22:06:23 +0100707ip6.arpa domains which are served for reverse-DNS queries. If not
Simon Kelleybaa80ae2013-05-29 16:32:07 +0100708specified, the prefix length defaults to 24 for IPv4 and 64 for IPv6.
709For IPv4 subnets, the prefix length should be have the value 8, 16 or 24
710unless you are familiar with RFC 2317 and have arranged the
Simon Kelleyc50f25a2013-11-21 11:29:27 +0000711in-addr.arpa delegation accordingly. Note that if no subnets are
712specified, then no reverse queries are answered.
Simon Kelley333b2ce2013-01-07 21:46:03 +0000713.TP
714.B --auth-soa=<serial>[,<hostmaster>[,<refresh>[,<retry>[,<expiry>]]]]
715Specify fields in the SOA record associated with authoritative
716zones. Note that this is optional, all the values are set to sane defaults.
717.TP
718.B --auth-sec-servers=<domain>[,<domain>[,<domain>...]]
719Specify any secondary servers for a zone for which dnsmasq is
720authoritative. These servers must be configured to get zone data from
721dnsmasq by zone transfer, and answer queries for the same
Simon Kelley6f130de2013-04-15 14:47:14 +0100722authoritative zones as dnsmasq.
Simon Kelley333b2ce2013-01-07 21:46:03 +0000723.TP
724.B --auth-peer=<ip-address>[,<ip-address>[,<ip-address>...]]
725Specify the addresses of secondary servers which are allowed to
726initiate zone transfer (AXFR) requests for zones for which dnsmasq is
Simon Kelley6f130de2013-04-15 14:47:14 +0100727authoritative. If this option is not given, then AXFR requests will be
Simon Kelley333b2ce2013-01-07 21:46:03 +0000728accepted from any secondary.
729.TP
Simon Kelley7de060b2011-08-26 17:24:52 +0100730.B --conntrack
731Read the Linux connection track mark associated with incoming DNS
732queries and set the same mark value on upstream traffic used to answer
733those queries. This allows traffic generated by dnsmasq to be
734associated with the queries which cause it, useful for bandwidth
735accounting and firewalling. Dnsmasq must have conntrack support
736compiled in and the kernel must have conntrack support
737included and configured. This option cannot be combined with
738--query-port.
739.TP
Simon Kelley49dc5702013-04-02 20:27:07 +0100740.B \-F, --dhcp-range=[tag:<tag>[,tag:<tag>],][set:<tag>,]<start-addr>[,<end-addr>][,<mode>][,<netmask>[,<broadcast>]][,<lease time>]
Simon Kelley1adadf52012-02-13 22:15:58 +0000741.TP
Simon Kelley83f28be2013-04-03 14:46:46 +0100742.B \-F, --dhcp-range=[tag:<tag>[,tag:<tag>],][set:<tag>,]<start-IPv6addr>[,<end-IPv6addr>|constructor:<interface>][,<mode>][,<prefix-len>][,<lease time>]
Simon Kelley1adadf52012-02-13 22:15:58 +0000743
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000744Enable the DHCP server. Addresses will be given out from the range
Simon Kelley44a2a312004-03-10 20:04:35 +0000745<start-addr> to <end-addr> and from statically defined addresses given
746in
747.B dhcp-host
748options. If the lease time is given, then leases
Simon Kelleyb8187c82005-11-26 21:46:27 +0000749will be given for that length of time. The lease time is in seconds,
Simon Kelley7622fc02009-06-04 20:32:05 +0100750or minutes (eg 45m) or hours (eg 1h) or "infinite". If not given,
751the default lease time is one hour. The
Simon Kelleyc8257542012-03-28 21:15:41 +0100752minimum lease time is two minutes. For IPv6 ranges, the lease time
753maybe "deprecated"; this sets the preferred lifetime sent in a DHCP
754lease or router advertisement to zero, which causes clients to use
755other addresses, if available, for new connections as a prelude to renumbering.
756
757This option may be repeated, with different addresses, to enable DHCP
Simon Kelley44a2a312004-03-10 20:04:35 +0000758service to more than one network. For directly connected networks (ie,
759networks on which the machine running dnsmasq has an interface) the
Simon Kelley7de060b2011-08-26 17:24:52 +0100760netmask is optional: dnsmasq will determine it from the interface
761configuration. For networks which receive DHCP service via a relay
762agent, dnsmasq cannot determine the netmask itself, so it should be
763specified, otherwise dnsmasq will have to guess, based on the class (A, B or
764C) of the network address. The broadcast address is
Simon Kelley7622fc02009-06-04 20:32:05 +0100765always optional. It is always
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100766allowed to have more than one dhcp-range in a single subnet.
767
Simon Kelley1adadf52012-02-13 22:15:58 +0000768For IPv6, the parameters are slightly different: instead of netmask
Vladislav Grishenko4c82efc2013-12-03 16:05:30 +0000769and broadcast address, there is an optional prefix length which must
770be equal to or larger then the prefix length on the local interface. If not
Simon Kelley1adadf52012-02-13 22:15:58 +0000771given, this defaults to 64. Unlike the IPv4 case, the prefix length is not
772automatically derived from the interface configuration. The mimimum
773size of the prefix length is 64.
774
Simon Kelley34d0a362013-01-02 11:40:56 +0000775IPv6 (only) supports another type of range. In this, the start address and optional end address contain only the network part (ie ::1) and they are followed by
776.B constructor:<interface>.
777This forms a template which describes how to create ranges, based on the addresses assigned to the interface. For instance
778
Simon Kelley83f28be2013-04-03 14:46:46 +0100779.B --dhcp-range=::1,::400,constructor:eth0
Simon Kelley34d0a362013-01-02 11:40:56 +0000780
Simon Kelley861c8912013-09-25 15:30:30 +0100781will look for addresses on
Simon Kelley429805d2013-05-31 13:47:26 +0100782eth0 and then create a range from <network>::1 to <network>::400. If
783the interface is assigned more than one network, then the
784corresponding ranges will be automatically created, and then
785deprecated and finally removed again as the address is deprecated and
786then deleted. The interface name may have a final "*" wildcard. Note
Simon Kelley861c8912013-09-25 15:30:30 +0100787that just any address on eth0 will not do: it must not be an
788autoconfigured or privacy address, or be deprecated.
Simon Kelley34d0a362013-01-02 11:40:56 +0000789
Vladislav Grishenkoe4cdbbf2013-08-19 16:20:31 +0100790If a dhcp-range is only being used for stateless DHCP and/or SLAAC,
791then the address can be simply ::
792
793.B --dhcp-range=::,constructor:eth0
794
Vladislav Grishenkoe4cdbbf2013-08-19 16:20:31 +0100795
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100796The optional
797.B set:<tag>
798sets an alphanumeric label which marks this network so that
Simon Kelley0a852542005-03-23 20:28:59 +0000799dhcp options may be specified on a per-network basis.
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100800When it is prefixed with 'tag:' instead, then its meaning changes from setting
Simon Kelleyc5ad4e72012-02-24 16:06:20 +0000801a tag to matching it. Only one tag may be set, but more than one tag
802may be matched.
803
Simon Kelleye8ca69e2012-03-26 21:23:26 +0100804The optional <mode> keyword may be
Simon Kelley33820b72004-04-03 21:10:00 +0100805.B static
806which tells dnsmasq to enable DHCP for the network specified, but not
Simon Kelley7622fc02009-06-04 20:32:05 +0100807to dynamically allocate IP addresses: only hosts which have static
Simon Kelley33820b72004-04-03 21:10:00 +0100808addresses given via
809.B dhcp-host
Simon Kelley52002052012-10-26 11:39:02 +0100810or from /etc/ethers will be served. A static-only subnet with address
811all zeros may be used as a "catch-all" address to enable replies to all
812Information-request packets on a subnet which is provided with
813stateless DHCPv6, ie
Moritz Warninge62e9b62014-03-20 15:32:22 +0000814.B --dhcp-range=::,static
Simon Kelleyc5ad4e72012-02-24 16:06:20 +0000815
Simon Kelleye46164e2012-04-16 16:39:38 +0100816For IPv4, the <mode> may be
Simon Kelley7622fc02009-06-04 20:32:05 +0100817.B proxy
818in which case dnsmasq will provide proxy-DHCP on the specified
819subnet. (See
820.B pxe-prompt
821and
822.B pxe-service
Simon Kelleye8ca69e2012-03-26 21:23:26 +0100823for details.)
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100824
Simon Kelleye8ca69e2012-03-26 21:23:26 +0100825For IPv6, the mode may be some combination of
Simon Kelley7ea3d3f2014-04-25 22:04:05 +0100826.B ra-only, slaac, ra-names, ra-stateless, ra-advrouter.
Simon Kelleye8ca69e2012-03-26 21:23:26 +0100827
Simon Kelleyc5ad4e72012-02-24 16:06:20 +0000828.B ra-only
Simon Kelleye8ca69e2012-03-26 21:23:26 +0100829tells dnsmasq to offer Router Advertisement only on this subnet,
830and not DHCP.
831
832.B slaac
833tells dnsmasq to offer Router Advertisement on this subnet and to set
834the A bit in the router advertisement, so that the client will use
835SLAAC addresses. When used with a DHCP range or static DHCP address
836this results in the client having both a DHCP-assigned and a SLAAC
837address.
838
839.B ra-stateless
840sends router advertisements with the O and A bits set, and provides a
841stateless DHCP service. The client will use a SLAAC address, and use
842DHCP for other configuration information.
843
Simon Kelley7023e382012-03-09 12:05:49 +0000844.B ra-names
Simon Kelleye8ca69e2012-03-26 21:23:26 +0100845enables a mode
Simon Kelley7023e382012-03-09 12:05:49 +0000846which gives DNS names to dual-stack hosts which do SLAAC for
Simon Kelley884a6df2012-03-20 16:20:22 +0000847IPv6. Dnsmasq uses the host's IPv4 lease to derive the name, network
Simon Kelley7023e382012-03-09 12:05:49 +0000848segment and MAC address and assumes that the host will also have an
Simon Kelleye46164e2012-04-16 16:39:38 +0100849IPv6 address calculated using the SLAAC algorithm, on the same network
Simon Kelley884a6df2012-03-20 16:20:22 +0000850segment. The address is pinged, and if a reply is received, an AAAA
851record is added to the DNS for this IPv6
Simon Kelley7023e382012-03-09 12:05:49 +0000852address. Note that this is only happens for directly-connected
Simon Kelley884a6df2012-03-20 16:20:22 +0000853networks, (not one doing DHCP via a relay) and it will not work
854if a host is using privacy extensions.
Simon Kelleye8ca69e2012-03-26 21:23:26 +0100855.B ra-names
856can be combined with
857.B ra-stateless
858and
859.B slaac.
Simon Kelleyc5ad4e72012-02-24 16:06:20 +0000860
Simon Kelley7ea3d3f2014-04-25 22:04:05 +0100861.B ra-advrouter
862enables a mode where router address(es) rather than prefix(es) are included in the advertisements.
863This is described in RFC-3775 section 7.2 and is used in mobile IPv6. In this mode the interval option
864is also included, as described in RFC-3775 section 7.3.
865
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000866.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100867.B \-G, --dhcp-host=[<hwaddr>][,id:<client_id>|*][,set:<tag>][,<ipaddr>][,<hostname>][,<lease_time>][,ignore]
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000868Specify per host parameters for the DHCP server. This allows a machine
869with a particular hardware address to be always allocated the same
870hostname, IP address and lease time. A hostname specified like this
871overrides any supplied by the DHCP client on the machine. It is also
Simon Kelleyc72daea2012-01-05 21:33:27 +0000872allowable to omit the hardware address and include the hostname, in
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000873which case the IP address and lease times will apply to any machine
874claiming that name. For example
875.B --dhcp-host=00:20:e0:3b:13:af,wap,infinite
876tells dnsmasq to give
Simon Kelleycdeda282006-03-16 20:16:06 +0000877the machine with hardware address 00:20:e0:3b:13:af the name wap, and
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000878an infinite DHCP lease.
879.B --dhcp-host=lap,192.168.0.199
880tells
881dnsmasq to always allocate the machine lap the IP address
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100882192.168.0.199.
883
884Addresses allocated like this are not constrained to be
885in the range given by the --dhcp-range option, but they must be in
886the same subnet as some valid dhcp-range. For
887subnets which don't need a pool of dynamically allocated addresses,
888use the "static" keyword in the dhcp-range declaration.
889
Simon Kelley89500e32013-09-20 16:29:20 +0100890It is allowed to use client identifiers (called client
891DUID in IPv6-land rather than
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000892hardware addresses to identify hosts by prefixing with 'id:'. Thus:
893.B --dhcp-host=id:01:02:03:04,.....
894refers to the host with client identifier 01:02:03:04. It is also
895allowed to specify the client ID as text, like this:
Simon Kelleya84fa1d2004-04-23 22:21:21 +0100896.B --dhcp-host=id:clientidastext,.....
Simon Kelley9009d742008-11-14 20:04:27 +0000897
Simon Kelley1adadf52012-02-13 22:15:58 +0000898A single
899.B dhcp-host
900may contain an IPv4 address or an IPv6 address, or both. IPv6 addresses must be bracketed by square brackets thus:
901.B --dhcp-host=laptop,[1234::56]
Simon Kelley30393102013-01-17 16:34:16 +0000902IPv6 addresses may contain only the host-identifier part:
903.B --dhcp-host=laptop,[::56]
Simon Kelley6f130de2013-04-15 14:47:14 +0100904in which case they act as wildcards in constructed dhcp ranges, with
Simon Kelley30393102013-01-17 16:34:16 +0000905the appropriate network part inserted.
Simon Kelley89500e32013-09-20 16:29:20 +0100906Note that in IPv6 DHCP, the hardware address may not be
907available, though it normally is for direct-connected clients, or
908clients using DHCP relays which support RFC 6939.
Simon Kelley1adadf52012-02-13 22:15:58 +0000909
Simon Kelley89500e32013-09-20 16:29:20 +0100910
911For DHCPv4, the special option id:* means "ignore any client-id
Simon Kelleya84fa1d2004-04-23 22:21:21 +0100912and use MAC addresses only." This is useful when a client presents a client-id sometimes
913but not others.
Simon Kelley9009d742008-11-14 20:04:27 +0000914
Simon Kelley1ab84e22004-01-29 16:48:35 +0000915If a name appears in /etc/hosts, the associated address can be
916allocated to a DHCP lease, but only if a
917.B --dhcp-host
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100918option specifying the name also exists. Only one hostname can be
919given in a
920.B dhcp-host
921option, but aliases are possible by using CNAMEs. (See
922.B --cname
923).
924
925The special keyword "ignore"
Simon Kelley33820b72004-04-03 21:10:00 +0100926tells dnsmasq to never offer a DHCP lease to a machine. The machine
927can be specified by hardware address, client ID or hostname, for
928instance
929.B --dhcp-host=00:20:e0:3b:13:af,ignore
930This is
931useful when there is another DHCP server on the network which should
Simon Kelley9009d742008-11-14 20:04:27 +0000932be used by some machines.
933
Tomas Hozzaa66d36e2013-04-22 15:08:07 +0100934The set:<tag> construct sets the tag
Simon Kelley9009d742008-11-14 20:04:27 +0000935whenever this dhcp-host directive is in use. This can be used to
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100936selectively send DHCP options just for this host. More than one tag
937can be set in a dhcp-host directive (but not in other places where
938"set:<tag>" is allowed). When a host matches any
Simon Kelley5aabfc72007-08-29 11:24:47 +0100939dhcp-host directive (or one implied by /etc/ethers) then the special
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100940tag "known" is set. This allows dnsmasq to be configured to
Simon Kelley5aabfc72007-08-29 11:24:47 +0100941ignore requests from unknown machines using
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100942.B --dhcp-ignore=tag:!known
Simon Kelley0a852542005-03-23 20:28:59 +0000943Ethernet addresses (but not client-ids) may have
944wildcard bytes, so for example
945.B --dhcp-host=00:20:e0:3b:13:*,ignore
Simon Kelleycdeda282006-03-16 20:16:06 +0000946will cause dnsmasq to ignore a range of hardware addresses. Note that
Simon Kelley0a852542005-03-23 20:28:59 +0000947the "*" will need to be escaped or quoted on a command line, but not
Simon Kelley9009d742008-11-14 20:04:27 +0000948in the configuration file.
949
950Hardware addresses normally match any
Simon Kelleycdeda282006-03-16 20:16:06 +0000951network (ARP) type, but it is possible to restrict them to a single
952ARP type by preceding them with the ARP-type (in HEX) and "-". so
953.B --dhcp-host=06-00:20:e0:3b:13:af,1.2.3.4
954will only match a
955Token-Ring hardware address, since the ARP-address type for token ring
Simon Kelley9009d742008-11-14 20:04:27 +0000956is 6.
957
Simon Kelley1adadf52012-02-13 22:15:58 +0000958As a special case, in DHCPv4, it is possible to include more than one
Simon Kelley73a08a22009-02-05 20:28:08 +0000959hardware address. eg:
960.B --dhcp-host=11:22:33:44:55:66,12:34:56:78:90:12,192.168.0.2
961This allows an IP address to be associated with
Simon Kelley9009d742008-11-14 20:04:27 +0000962multiple hardware addresses, and gives dnsmasq permission to abandon a
963DHCP lease to one of the hardware addresses when another one asks for
964a lease. Beware that this is a dangerous thing to do, it will only
965work reliably if only one of the hardware addresses is active at any
Simon Kelley73a08a22009-02-05 20:28:08 +0000966time and there is no way for dnsmasq to enforce this. It is, for instance,
967useful to allocate a stable IP address to a laptop which
Simon Kelley9009d742008-11-14 20:04:27 +0000968has both wired and wireless interfaces.
Simon Kelley5aabfc72007-08-29 11:24:47 +0100969.TP
Simon Kelley28866e92011-02-14 20:19:14 +0000970.B --dhcp-hostsfile=<path>
971Read DHCP host information from the specified file. If a directory
972is given, then read all the files contained in that directory. The file contains
Simon Kelley5aabfc72007-08-29 11:24:47 +0100973information about one host per line. The format of a line is the same
974as text to the right of '=' in --dhcp-host. The advantage of storing DHCP host information
975in this file is that it can be changed without re-starting dnsmasq:
976the file will be re-read when dnsmasq receives SIGHUP.
Simon Kelley824af852008-02-12 20:43:05 +0000977.TP
Simon Kelley28866e92011-02-14 20:19:14 +0000978.B --dhcp-optsfile=<path>
979Read DHCP option information from the specified file. If a directory
980is given, then read all the files contained in that directory. The advantage of
Simon Kelley824af852008-02-12 20:43:05 +0000981using this option is the same as for --dhcp-hostsfile: the
Simon Kelley1f15b812009-10-13 17:49:32 +0100982dhcp-optsfile will be re-read when dnsmasq receives SIGHUP. Note that
983it is possible to encode the information in a
Simon Kelley5f4dc5c2015-01-20 20:51:02 +0000984.TP
985.B --dhcp-hostsdir=<path>
Simon Kelley3d04f462015-01-31 21:59:13 +0000986This is equivalent to dhcp-hostsfile, except for the following. The path MUST be a
Simon Kelley5f4dc5c2015-01-20 20:51:02 +0000987directory, and not an individual file. Changed or new files within
988the directory are read automatically, without the need to send SIGHUP.
989If a file is deleted for changed after it has been read by dnsmasq, then the
990host record it contained will remain until dnsmasq recieves a SIGHUP, or
991is restarted; ie host records are only added dynamically.
Simon Kelley3d04f462015-01-31 21:59:13 +0000992.B --dhcp-optsdir=<path>
993This is equivalent to dhcp-optsfile, with the differences noted for --dhcp-hostsdir.
Simon Kelley5f4dc5c2015-01-20 20:51:02 +0000994.TP
Simon Kelley1f15b812009-10-13 17:49:32 +0100995.B --dhcp-boot
996flag as DHCP options, using the options names bootfile-name,
997server-ip-address and tftp-server. This allows these to be included
998in a dhcp-optsfile.
Simon Kelley44a2a312004-03-10 20:04:35 +0000999.TP
1000.B \-Z, --read-ethers
1001Read /etc/ethers for information about hosts for the DHCP server. The
1002format of /etc/ethers is a hardware address, followed by either a
1003hostname or dotted-quad IP address. When read by dnsmasq these lines
1004have exactly the same effect as
1005.B --dhcp-host
Simon Kelley5aabfc72007-08-29 11:24:47 +01001006options containing the same information. /etc/ethers is re-read when
Simon Kelley1adadf52012-02-13 22:15:58 +00001007dnsmasq receives SIGHUP. IPv6 addresses are NOT read from /etc/ethers.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001008.TP
Simon Kelley1adadf52012-02-13 22:15:58 +00001009.B \-O, --dhcp-option=[tag:<tag>,[tag:<tag>,]][encap:<opt>,][vi-encap:<enterprise>,][vendor:[<vendor-class>],][<opt>|option:<opt-name>|option6:<opt>|option6:<opt-name>],[<value>[,<value>]]
Simon Kelleyb8187c82005-11-26 21:46:27 +00001010Specify different or extra options to DHCP clients. By default,
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001011dnsmasq sends some standard options to DHCP clients, the netmask and
1012broadcast address are set to the same as the host running dnsmasq, and
1013the DNS server and default route are set to the address of the machine
Simon Kelley1adadf52012-02-13 22:15:58 +00001014running dnsmasq. (Equivalent rules apply for IPv6.) If the domain name option has been set, that is sent.
Simon Kelleyf2621c72007-04-29 19:47:21 +01001015This configuration allows these defaults to be overridden,
1016or other options specified. The option, to be sent may be given as a
1017decimal number or as "option:<option-name>" The option numbers are
1018specified in RFC2132 and subsequent RFCs. The set of option-names
1019known by dnsmasq can be discovered by running "dnsmasq --help dhcp".
1020For example, to set the default route option to
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001021192.168.4.4, do
Simon Kelleyf2621c72007-04-29 19:47:21 +01001022.B --dhcp-option=3,192.168.4.4
1023or
1024.B --dhcp-option = option:router, 192.168.4.4
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001025and to set the time-server address to 192.168.0.4, do
Simon Kelleyf2621c72007-04-29 19:47:21 +01001026.B --dhcp-option = 42,192.168.0.4
1027or
1028.B --dhcp-option = option:ntp-server, 192.168.0.4
Simon Kelleyc3a04082014-01-11 22:18:19 +00001029The special address 0.0.0.0 is taken to mean "the address of the
1030machine running dnsmasq".
1031
1032Data types allowed are comma separated
1033dotted-quad IPv4 addresses, []-wrapped IPv6 addresses, a decimal number, colon-separated hex digits
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001034and a text string. If the optional tags are given then
1035this option is only sent when all the tags are matched.
Simon Kelley91dccd02005-03-31 17:48:32 +01001036
Simon Kelleycdeda282006-03-16 20:16:06 +00001037Special processing is done on a text argument for option 119, to
Simon Kelley832af0b2007-01-21 20:01:28 +00001038conform with RFC 3397. Text or dotted-quad IP addresses as arguments
1039to option 120 are handled as per RFC 3361. Dotted-quad IP addresses
1040which are followed by a slash and then a netmask size are encoded as
1041described in RFC 3442.
Simon Kelleycdeda282006-03-16 20:16:06 +00001042
Simon Kelley1adadf52012-02-13 22:15:58 +00001043IPv6 options are specified using the
1044.B option6:
1045keyword, followed by the option number or option name. The IPv6 option
1046name space is disjoint from the IPv4 option name space. IPv6 addresses
1047in options must be bracketed with square brackets, eg.
1048.B --dhcp-option=option6:ntp-server,[1234::56]
Simon Kelleyc3a04082014-01-11 22:18:19 +00001049For IPv6, [::] means "the global address of
1050the machine running dnsmasq", whilst [fd00::] is replaced with the
1051ULA, if it exists, and [fe80::] with the link-local address.
Simon Kelley1adadf52012-02-13 22:15:58 +00001052
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001053Be careful: no checking is done that the correct type of data for the
Simon Kelley26128d22004-11-14 16:43:54 +00001054option number is sent, it is quite possible to
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001055persuade dnsmasq to generate illegal DHCP packets with injudicious use
Simon Kelley91dccd02005-03-31 17:48:32 +01001056of this flag. When the value is a decimal number, dnsmasq must determine how
1057large the data item is. It does this by examining the option number and/or the
Simon Kelleyb8187c82005-11-26 21:46:27 +00001058value, but can be overridden by appending a single letter flag as follows:
Simon Kelley91dccd02005-03-31 17:48:32 +01001059b = one byte, s = two bytes, i = four bytes. This is mainly useful with
Simon Kelley3d8df262005-08-29 12:19:27 +01001060encapsulated vendor class options (see below) where dnsmasq cannot
1061determine data size from the option number. Option data which
1062consists solely of periods and digits will be interpreted by dnsmasq
1063as an IP address, and inserted into an option as such. To force a
1064literal string, use quotes. For instance when using option 66 to send
1065a literal IP address as TFTP server name, it is necessary to do
1066.B --dhcp-option=66,"1.2.3.4"
Simon Kelley91dccd02005-03-31 17:48:32 +01001067
Simon Kelley1adadf52012-02-13 22:15:58 +00001068Encapsulated Vendor-class options may also be specified (IPv4 only) using
Simon Kelley91dccd02005-03-31 17:48:32 +01001069--dhcp-option: for instance
Simon Kelley1b7ecd12007-02-05 14:57:57 +00001070.B --dhcp-option=vendor:PXEClient,1,0.0.0.0
1071sends the encapsulated vendor
1072class-specific option "mftp-address=0.0.0.0" to any client whose
1073vendor-class matches "PXEClient". The vendor-class matching is
Simon Kelley6b010842007-02-12 20:32:07 +00001074substring based (see --dhcp-vendorclass for details). If a
1075vendor-class option (number 60) is sent by dnsmasq, then that is used
1076for selecting encapsulated options in preference to any sent by the
1077client. It is
Simon Kelley1b7ecd12007-02-05 14:57:57 +00001078possible to omit the vendorclass completely;
1079.B --dhcp-option=vendor:,1,0.0.0.0
Simon Kelley1adadf52012-02-13 22:15:58 +00001080in which case the encapsulated option is always sent.
Simon Kelley73a08a22009-02-05 20:28:08 +00001081
Simon Kelley1adadf52012-02-13 22:15:58 +00001082Options may be encapsulated (IPv4 only) within other options: for instance
Simon Kelley73a08a22009-02-05 20:28:08 +00001083.B --dhcp-option=encap:175, 190, "iscsi-client0"
1084will send option 175, within which is the option 190. If multiple
1085options are given which are encapsulated with the same option number
1086then they will be correctly combined into one encapsulated option.
1087encap: and vendor: are may not both be set in the same dhcp-option.
1088
Simon Kelley316e2732010-01-22 20:16:09 +00001089The final variant on encapsulated options is "Vendor-Identifying
1090Vendor Options" as specified by RFC3925. These are denoted like this:
1091.B --dhcp-option=vi-encap:2, 10, "text"
1092The number in the vi-encap: section is the IANA enterprise number
Simon Kelley1adadf52012-02-13 22:15:58 +00001093used to identify this option. This form of encapsulation is supported
1094in IPv6.
1095
Simon Kelley1b7ecd12007-02-05 14:57:57 +00001096The address 0.0.0.0 is not treated specially in
Simon Kelley73a08a22009-02-05 20:28:08 +00001097encapsulated options.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001098.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001099.B --dhcp-option-force=[tag:<tag>,[tag:<tag>,]][encap:<opt>,][vi-encap:<enterprise>,][vendor:[<vendor-class>],]<opt>,[<value>[,<value>]]
Simon Kelley6b010842007-02-12 20:32:07 +00001100This works in exactly the same way as
Simon Kelleyf2621c72007-04-29 19:47:21 +01001101.B --dhcp-option
1102except that the option will always be sent, even if the client does
Simon Kelley6b010842007-02-12 20:32:07 +00001103not ask for it in the parameter request list. This is sometimes
1104needed, for example when sending options to PXELinux.
1105.TP
Simon Kelley824af852008-02-12 20:43:05 +00001106.B --dhcp-no-override
Simon Kelley1adadf52012-02-13 22:15:58 +00001107(IPv4 only) Disable re-use of the DHCP servername and filename fields as extra
Simon Kelley824af852008-02-12 20:43:05 +00001108option space. If it can, dnsmasq moves the boot server and filename
1109information (from dhcp-boot) out of their dedicated fields into
1110DHCP options. This make extra space available in the DHCP packet for
1111options but can, rarely, confuse old or broken clients. This flag
1112forces "simple and safe" behaviour to avoid problems in such a case.
1113.TP
Simon Kelleyff7eea22013-09-04 18:01:38 +01001114.B --dhcp-relay=<local address>,<server address>[,<interface]
1115Configure dnsmasq to do DHCP relay. The local address is an address
1116allocated to an interface on the host running dnsmasq. All DHCP
1117requests arriving on that interface will we relayed to a remote DHCP
1118server at the server address. It is possible to relay from a single local
1119address to multiple remote servers by using multiple dhcp-relay
1120configs with the same local address and different server
1121addresses. A server address must be an IP literal address, not a
1122domain name. In the case of DHCPv6, the server address may be the
1123ALL_SERVERS multicast address, ff05::1:3. In this case the interface
1124must be given, not be wildcard, and is used to direct the multicast to the
1125correct interface to reach the DHCP server.
1126
1127Access control for DHCP clients has the same rules as for the DHCP
1128server, see --interface, --except-interface, etc. The optional
1129interface name in the dhcp-relay config has a different function: it
1130controls on which interface DHCP replies from the server will be
1131accepted. This is intended for configurations which have three
1132interfaces: one being relayed from, a second connecting the DHCP
1133server, and a third untrusted network, typically the wider
1134internet. It avoids the possibility of spoof replies arriving via this
1135third interface.
1136
1137It is allowed to have dnsmasq act as a DHCP server on one set of
1138interfaces and relay from a disjoint set of interfaces. Note that
1139whilst it is quite possible to write configurations which appear to
1140act as a server and a relay on the same interface, this is not
1141supported: the relay function will take precedence.
1142
1143Both DHCPv4 and DHCPv6 relay is supported. It's not possible to relay
1144DHCPv4 to a DHCPv6 server or vice-versa.
1145.TP
Simon Kelley1adadf52012-02-13 22:15:58 +00001146.B \-U, --dhcp-vendorclass=set:<tag>,[enterprise:<IANA-enterprise number>,]<vendor-class>
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001147Map from a vendor-class string to a tag. Most DHCP clients provide a
Simon Kelleya2226412004-05-13 20:27:08 +01001148"vendor class" which represents, in some sense, the type of host. This option
Simon Kelleyf2621c72007-04-29 19:47:21 +01001149maps vendor classes to tags, so that DHCP options may be selectively delivered
Simon Kelleya84fa1d2004-04-23 22:21:21 +01001150to different classes of hosts. For example
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001151.B dhcp-vendorclass=set:printers,Hewlett-Packard JetDirect
Simon Kelleya84fa1d2004-04-23 22:21:21 +01001152will allow options to be set only for HP printers like so:
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001153.B --dhcp-option=tag:printers,3,192.168.4.4
Simon Kelleya2226412004-05-13 20:27:08 +01001154The vendor-class string is
1155substring matched against the vendor-class supplied by the client, to
Simon Kelley1adadf52012-02-13 22:15:58 +00001156allow fuzzy matching. The set: prefix is optional but allowed for
1157consistency.
1158
1159Note that in IPv6 only, vendorclasses are namespaced with an
1160IANA-allocated enterprise number. This is given with enterprise:
1161keyword and specifies that only vendorclasses matching the specified
1162number should be searched.
Simon Kelleya2226412004-05-13 20:27:08 +01001163.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001164.B \-j, --dhcp-userclass=set:<tag>,<user-class>
1165Map from a user-class string to a tag (with substring
Simon Kelleya2226412004-05-13 20:27:08 +01001166matching, like vendor classes). Most DHCP clients provide a
1167"user class" which is configurable. This option
Simon Kelleyf2621c72007-04-29 19:47:21 +01001168maps user classes to tags, so that DHCP options may be selectively delivered
Simon Kelleya2226412004-05-13 20:27:08 +01001169to different classes of hosts. It is possible, for instance to use
1170this to set a different printer server for hosts in the class
1171"accounts" than for hosts in the class "engineering".
Simon Kelleya84fa1d2004-04-23 22:21:21 +01001172.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001173.B \-4, --dhcp-mac=set:<tag>,<MAC address>
Simon Kelley89500e32013-09-20 16:29:20 +01001174Map from a MAC address to a tag. The MAC address may include
Simon Kelleycdeda282006-03-16 20:16:06 +00001175wildcards. For example
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001176.B --dhcp-mac=set:3com,01:34:23:*:*:*
Simon Kelleycdeda282006-03-16 20:16:06 +00001177will set the tag "3com" for any host whose MAC address matches the pattern.
1178.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001179.B --dhcp-circuitid=set:<tag>,<circuit-id>, --dhcp-remoteid=set:<tag>,<remote-id>
1180Map from RFC3046 relay agent options to tags. This data may
Simon Kelleyf2621c72007-04-29 19:47:21 +01001181be provided by DHCP relay agents. The circuit-id or remote-id is
1182normally given as colon-separated hex, but is also allowed to be a
1183simple string. If an exact match is achieved between the circuit or
Simon Kelley1adadf52012-02-13 22:15:58 +00001184agent ID and one provided by a relay agent, the tag is set.
1185
1186.B dhcp-remoteid
1187(but not dhcp-circuitid) is supported in IPv6.
Simon Kelleyf2621c72007-04-29 19:47:21 +01001188.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001189.B --dhcp-subscrid=set:<tag>,<subscriber-id>
Simon Kelley1adadf52012-02-13 22:15:58 +00001190(IPv4 and IPv6) Map from RFC3993 subscriber-id relay agent options to tags.
Simon Kelley824af852008-02-12 20:43:05 +00001191.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001192.B --dhcp-proxy[=<ip addr>]......
Simon Kelley07933802012-02-14 20:55:25 +00001193(IPv4 only) A normal DHCP relay agent is only used to forward the initial parts of
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001194a DHCP interaction to the DHCP server. Once a client is configured, it
1195communicates directly with the server. This is undesirable if the
Tomas Hozzaa66d36e2013-04-22 15:08:07 +01001196relay agent is adding extra information to the DHCP packets, such as
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001197that used by
1198.B dhcp-circuitid
1199and
1200.B dhcp-remoteid.
1201A full relay implementation can use the RFC 5107 serverid-override
1202option to force the DHCP server to use the relay as a full proxy, with all
1203packets passing through it. This flag provides an alternative method
1204of doing the same thing, for relays which don't support RFC
12055107. Given alone, it manipulates the server-id for all interactions
1206via relays. If a list of IP addresses is given, only interactions via
1207relays at those addresses are affected.
1208.TP
1209.B --dhcp-match=set:<tag>,<option number>|option:<option name>|vi-encap:<enterprise>[,<value>]
1210Without a value, set the tag if the client sends a DHCP
Simon Kelley73a08a22009-02-05 20:28:08 +00001211option of the given number or name. When a value is given, set the tag only if
1212the option is sent and matches the value. The value may be of the form
Tomas Hozzaa66d36e2013-04-22 15:08:07 +01001213"01:ff:*:02" in which case the value must match (apart from wildcards)
Simon Kelley73a08a22009-02-05 20:28:08 +00001214but the option sent may have unmatched data past the end of the
1215value. The value may also be of the same form as in
1216.B dhcp-option
1217in which case the option sent is treated as an array, and one element
1218must match, so
1219
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001220--dhcp-match=set:efi-ia32,option:client-arch,6
Simon Kelley73a08a22009-02-05 20:28:08 +00001221
1222will set the tag "efi-ia32" if the the number 6 appears in the list of
1223architectures sent by the client in option 93. (See RFC 4578 for
Simon Kelley316e2732010-01-22 20:16:09 +00001224details.) If the value is a string, substring matching is used.
1225
Tomas Hozzaa66d36e2013-04-22 15:08:07 +01001226The special form with vi-encap:<enterprise number> matches against
Simon Kelley316e2732010-01-22 20:16:09 +00001227vendor-identifying vendor classes for the specified enterprise. Please
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001228see RFC 3925 for more details of these rare and interesting beasts.
Simon Kelleyf2621c72007-04-29 19:47:21 +01001229.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001230.B --tag-if=set:<tag>[,set:<tag>[,tag:<tag>[,tag:<tag>]]]
1231Perform boolean operations on tags. Any tag appearing as set:<tag> is set if
1232all the tags which appear as tag:<tag> are set, (or unset when tag:!<tag> is used)
1233If no tag:<tag> appears set:<tag> tags are set unconditionally.
1234Any number of set: and tag: forms may appear, in any order.
1235Tag-if lines ares executed in order, so if the tag in tag:<tag> is a
1236tag set by another
1237.B tag-if,
1238the line which sets the tag must precede the one which tests it.
1239.TP
1240.B \-J, --dhcp-ignore=tag:<tag>[,tag:<tag>]
1241When all the given tags appear in the tag set ignore the host and do
Simon Kelley26128d22004-11-14 16:43:54 +00001242not allocate it a DHCP lease.
1243.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001244.B --dhcp-ignore-names[=tag:<tag>[,tag:<tag>]]
1245When all the given tags appear in the tag set, ignore any hostname
Simon Kelley9e038942008-05-30 20:06:34 +01001246provided by the host. Note that, unlike dhcp-ignore, it is permissible
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001247to supply no tags, in which case DHCP-client supplied hostnames
Simon Kelley832af0b2007-01-21 20:01:28 +00001248are always ignored, and DHCP hosts are added to the DNS using only
1249dhcp-host configuration in dnsmasq and the contents of /etc/hosts and
1250/etc/ethers.
1251.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001252.B --dhcp-generate-names=tag:<tag>[,tag:<tag>]
Simon Kelley1adadf52012-02-13 22:15:58 +00001253(IPv4 only) Generate a name for DHCP clients which do not otherwise have one,
Tomas Hozzaa66d36e2013-04-22 15:08:07 +01001254using the MAC address expressed in hex, separated by dashes. Note that
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001255if a host provides a name, it will be used by preference to this,
1256unless
1257.B --dhcp-ignore-names
1258is set.
1259.TP
1260.B --dhcp-broadcast[=tag:<tag>[,tag:<tag>]]
Simon Kelley1adadf52012-02-13 22:15:58 +00001261(IPv4 only) When all the given tags appear in the tag set, always use broadcast to
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001262communicate with the host when it is unconfigured. It is permissible
1263to supply no tags, in which case this is unconditional. Most DHCP clients which
Simon Kelley824af852008-02-12 20:43:05 +00001264need broadcast replies set a flag in their requests so that this
1265happens automatically, some old BOOTP clients do not.
1266.TP
Simon Kelley7de060b2011-08-26 17:24:52 +01001267.B \-M, --dhcp-boot=[tag:<tag>,]<filename>,[<servername>[,<server address>|<tftp_servername>]]
Simon Kelley1adadf52012-02-13 22:15:58 +00001268(IPv4 only) Set BOOTP options to be returned by the DHCP server. Server name and
Simon Kelley832af0b2007-01-21 20:01:28 +00001269address are optional: if not provided, the name is left empty, and the
1270address set to the address of the machine running dnsmasq. If dnsmasq
1271is providing a TFTP service (see
1272.B --enable-tftp
1273) then only the filename is required here to enable network booting.
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001274If the optional tag(s) are given,
1275they must match for this configuration to be sent.
Simon Kelley7de060b2011-08-26 17:24:52 +01001276Instead of an IP address, the TFTP server address can be given as a domain
1277name which is looked up in /etc/hosts. This name can be associated in
1278/etc/hosts with multiple IP addresses, which are used round-robin.
1279This facility can be used to load balance the tftp load among a set of servers.
1280.TP
1281.B --dhcp-sequential-ip
1282Dnsmasq is designed to choose IP addresses for DHCP clients using a
1283hash of the client's MAC address. This normally allows a client's
1284address to remain stable long-term, even if the client sometimes allows its DHCP
1285lease to expire. In this default mode IP addresses are distributed
1286pseudo-randomly over the entire available address range. There are
1287sometimes circumstances (typically server deployment) where it is more
1288convenient to have IP
1289addresses allocated sequentially, starting from the lowest available
1290address, and setting this flag enables this mode. Note that in the
1291sequential mode, clients which allow a lease to expire are much more
1292likely to move IP address; for this reason it should not be generally used.
Simon Kelley7622fc02009-06-04 20:32:05 +01001293.TP
Simon Kelley751d6f42012-02-10 15:24:51 +00001294.B --pxe-service=[tag:<tag>,]<CSA>,<menu text>[,<basename>|<bootservicetype>][,<server address>|<server_name>]
Simon Kelley7622fc02009-06-04 20:32:05 +01001295Most uses of PXE boot-ROMS simply allow the PXE
1296system to obtain an IP address and then download the file specified by
1297.B dhcp-boot
1298and execute it. However the PXE system is capable of more complex
1299functions when supported by a suitable DHCP server.
1300
1301This specifies a boot option which may appear in a PXE boot menu. <CSA> is
1302client system type, only services of the correct type will appear in a
1303menu. The known types are x86PC, PC98, IA64_EFI, Alpha, Arc_x86,
1304Intel_Lean_Client, IA32_EFI, BC_EFI, Xscale_EFI and X86-64_EFI; an
1305integer may be used for other types. The
1306parameter after the menu text may be a file name, in which case dnsmasq acts as a
1307boot server and directs the PXE client to download the file by TFTP,
1308either from itself (
1309.B enable-tftp
Simon Kelley751d6f42012-02-10 15:24:51 +00001310must be set for this to work) or another TFTP server if the final server
1311address/name is given.
Simon Kelley7622fc02009-06-04 20:32:05 +01001312Note that the "layer"
1313suffix (normally ".0") is supplied by PXE, and should not be added to
1314the basename. If an integer boot service type, rather than a basename
1315is given, then the PXE client will search for a
1316suitable boot service for that type on the network. This search may be done
Simon Kelley751d6f42012-02-10 15:24:51 +00001317by broadcast, or direct to a server if its IP address/name is provided.
Simon Kelley316e2732010-01-22 20:16:09 +00001318If no boot service type or filename is provided (or a boot service type of 0 is specified)
1319then the menu entry will abort the net boot procedure and
Simon Kelley751d6f42012-02-10 15:24:51 +00001320continue booting from local media. The server address can be given as a domain
1321name which is looked up in /etc/hosts. This name can be associated in
1322/etc/hosts with multiple IP addresses, which are used round-robin.
Simon Kelley7622fc02009-06-04 20:32:05 +01001323.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001324.B --pxe-prompt=[tag:<tag>,]<prompt>[,<timeout>]
Simon Kelley7622fc02009-06-04 20:32:05 +01001325Setting this provides a prompt to be displayed after PXE boot. If the
1326timeout is given then after the
1327timeout has elapsed with no keyboard input, the first available menu
1328option will be automatically executed. If the timeout is zero then the first available menu
1329item will be executed immediately. If
1330.B pxe-prompt
Tomas Hozzaa66d36e2013-04-22 15:08:07 +01001331is omitted the system will wait for user input if there are multiple
Simon Kelley7622fc02009-06-04 20:32:05 +01001332items in the menu, but boot immediately if
1333there is only one. See
1334.B pxe-service
1335for details of menu items.
1336
1337Dnsmasq supports PXE "proxy-DHCP", in this case another DHCP server on
1338the network is responsible for allocating IP addresses, and dnsmasq
1339simply provides the information given in
1340.B pxe-prompt
1341and
1342.B pxe-service
1343to allow netbooting. This mode is enabled using the
1344.B proxy
1345keyword in
1346.B dhcp-range.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001347.TP
Simon Kelley44a2a312004-03-10 20:04:35 +00001348.B \-X, --dhcp-lease-max=<number>
1349Limits dnsmasq to the specified maximum number of DHCP leases. The
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001350default is 1000. This limit is to prevent DoS attacks from hosts which
Simon Kelley44a2a312004-03-10 20:04:35 +00001351create thousands of leases and use lots of memory in the dnsmasq
1352process.
1353.TP
Simon Kelleyfd9fa482004-10-21 20:24:00 +01001354.B \-K, --dhcp-authoritative
Simon Kelley095f6252013-01-30 11:31:02 +00001355Should be set when dnsmasq is definitely the only DHCP server on a network.
1356For DHCPv4, it changes the behaviour from strict RFC compliance so that DHCP requests on
Simon Kelleyfd9fa482004-10-21 20:24:00 +01001357unknown leases from unknown hosts are not ignored. This allows new hosts
Simon Kelleycdeda282006-03-16 20:16:06 +00001358to get a lease without a tedious timeout under all circumstances. It also
1359allows dnsmasq to rebuild its lease database without each client needing to
Simon Kelley095f6252013-01-30 11:31:02 +00001360reacquire a lease, if the database is lost. For DHCPv6 it sets the
1361priority in replies to 255 (the maximum) instead of 0 (the minimum).
Simon Kelley9e038942008-05-30 20:06:34 +01001362.TP
1363.B --dhcp-alternate-port[=<server port>[,<client port>]]
Simon Kelley1adadf52012-02-13 22:15:58 +00001364(IPv4 only) Change the ports used for DHCP from the default. If this option is
Simon Kelley9e038942008-05-30 20:06:34 +01001365given alone, without arguments, it changes the ports used for DHCP
1366from 67 and 68 to 1067 and 1068. If a single argument is given, that
1367port number is used for the server and the port number plus one used
1368for the client. Finally, two port numbers allows arbitrary
1369specification of both server and client ports for DHCP.
Simon Kelleyfd9fa482004-10-21 20:24:00 +01001370.TP
Simon Kelley9009d742008-11-14 20:04:27 +00001371.B \-3, --bootp-dynamic[=<network-id>[,<network-id>]]
Simon Kelley1adadf52012-02-13 22:15:58 +00001372(IPv4 only) Enable dynamic allocation of IP addresses to BOOTP clients. Use this
Simon Kelley3d8df262005-08-29 12:19:27 +01001373with care, since each address allocated to a BOOTP client is leased
1374forever, and therefore becomes permanently unavailable for re-use by
Simon Kelley9009d742008-11-14 20:04:27 +00001375other hosts. if this is given without tags, then it unconditionally
1376enables dynamic allocation. With tags, only when the tags are all
1377set. It may be repeated with different tag sets.
Simon Kelley3d8df262005-08-29 12:19:27 +01001378.TP
Simon Kelley5e9e0ef2006-04-17 14:24:29 +01001379.B \-5, --no-ping
Simon Kelley1adadf52012-02-13 22:15:58 +00001380(IPv4 only) By default, the DHCP server will attempt to ensure that an address in
Simon Kelley5e9e0ef2006-04-17 14:24:29 +01001381not in use before allocating it to a host. It does this by sending an
1382ICMP echo request (aka "ping") to the address in question. If it gets
1383a reply, then the address must already be in use, and another is
1384tried. This flag disables this check. Use with caution.
1385.TP
Simon Kelleyf2621c72007-04-29 19:47:21 +01001386.B --log-dhcp
1387Extra logging for DHCP: log all the options sent to DHCP clients and
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001388the tags used to determine them.
Simon Kelleyf2621c72007-04-29 19:47:21 +01001389.TP
Kevin Darbyshire-Bryant8c0b73d2013-10-11 11:56:33 +01001390.B --quiet-dhcp, --quiet-dhcp6, --quiet-ra
1391Suppress logging of the routine operation of these protocols. Errors and
1392problems will still be logged. --quiet-dhcp and quiet-dhcp6 are
1393over-ridden by --log-dhcp.
1394.TP
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001395.B \-l, --dhcp-leasefile=<path>
Simon Kelley73a08a22009-02-05 20:28:08 +00001396Use the specified file to store DHCP lease information.
Simon Kelley208b65c2006-08-05 21:41:37 +01001397.TP
Simon Kelley8b372702012-03-09 17:45:10 +00001398.B --dhcp-duid=<enterprise-id>,<uid>
1399(IPv6 only) Specify the server persistent UID which the DHCPv6 server
1400will use. This option is not normally required as dnsmasq creates a
1401DUID automatically when it is first needed. When given, this option
1402provides dnsmasq the data required to create a DUID-EN type DUID. Note
1403that once set, the DUID is stored in the lease database, so to change between DUID-EN and
1404automatically created DUIDs or vice-versa, the lease database must be
1405re-intialised. The enterprise-id is assigned by IANA, and the uid is a
1406string of hex octets unique to a particular device.
1407.TP
Simon Kelley7cebd202006-05-06 14:13:33 +01001408.B \-6 --dhcp-script=<path>
Simon Kelleya9530962012-03-20 22:07:35 +00001409Whenever a new DHCP lease is created, or an old one destroyed, or a
1410TFTP file transfer completes, the
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001411executable specified by this option is run. <path>
1412must be an absolute pathname, no PATH search occurs.
1413The arguments to the process
Simon Kelley7cebd202006-05-06 14:13:33 +01001414are "add", "old" or "del", the MAC
Simon Kelley1adadf52012-02-13 22:15:58 +00001415address of the host (or DUID for IPv6) , the IP address, and the hostname,
Simon Kelley7cebd202006-05-06 14:13:33 +01001416if known. "add" means a lease has been created, "del" means it has
1417been destroyed, "old" is a notification of an existing lease when
Simon Kelley208b65c2006-08-05 21:41:37 +01001418dnsmasq starts or a change to MAC address or hostname of an existing
1419lease (also, lease length or expiry and client-id, if leasefile-ro is set).
Simon Kelley9009d742008-11-14 20:04:27 +00001420If the MAC address is from a network type other than ethernet,
1421it will have the network type prepended, eg "06-01:23:45:67:89:ab" for
1422token ring. The process is run as root (assuming that dnsmasq was originally run as
Simon Kelley16972692006-10-16 20:04:18 +01001423root) even if dnsmasq is configured to change UID to an unprivileged user.
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001424
1425The environment is inherited from the invoker of dnsmasq, with some or
Simon Kelley1adadf52012-02-13 22:15:58 +00001426all of the following variables added
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001427
Simon Kelley1adadf52012-02-13 22:15:58 +00001428For both IPv4 and IPv6:
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001429
1430DNSMASQ_DOMAIN if the fully-qualified domain name of the host is
Simon Kelley28866e92011-02-14 20:19:14 +00001431known, this is set to the domain part. (Note that the hostname passed
1432to the script as an argument is never fully-qualified.)
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001433
Simon Kelley1adadf52012-02-13 22:15:58 +00001434If the client provides a hostname, DNSMASQ_SUPPLIED_HOSTNAME
1435
1436If the client provides user-classes, DNSMASQ_USER_CLASS0..DNSMASQ_USER_CLASSn
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001437
1438If dnsmasq was compiled with HAVE_BROKEN_RTC, then
Simon Kelley208b65c2006-08-05 21:41:37 +01001439the length of the lease (in seconds) is stored in
Simon Kelley16972692006-10-16 20:04:18 +01001440DNSMASQ_LEASE_LENGTH, otherwise the time of lease expiry is stored in
Simon Kelley5aabfc72007-08-29 11:24:47 +01001441DNSMASQ_LEASE_EXPIRES. The number of seconds until lease expiry is
1442always stored in DNSMASQ_TIME_REMAINING.
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001443
Simon Kelley5aabfc72007-08-29 11:24:47 +01001444If a lease used to have a hostname, which is
Simon Kelley16972692006-10-16 20:04:18 +01001445removed, an "old" event is generated with the new state of the lease,
1446ie no name, and the former name is provided in the environment
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001447variable DNSMASQ_OLD_HOSTNAME.
1448
1449DNSMASQ_INTERFACE stores the name of
Simon Kelley9e038942008-05-30 20:06:34 +01001450the interface on which the request arrived; this is not set for "old"
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001451actions when dnsmasq restarts.
1452
1453DNSMASQ_RELAY_ADDRESS is set if the client
Simon Kelley316e2732010-01-22 20:16:09 +00001454used a DHCP relay to contact dnsmasq and the IP address of the relay
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001455is known.
1456
1457DNSMASQ_TAGS contains all the tags set during the
Simon Kelley316e2732010-01-22 20:16:09 +00001458DHCP transaction, separated by spaces.
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001459
Simon Kelleye46164e2012-04-16 16:39:38 +01001460DNSMASQ_LOG_DHCP is set if
1461.B --log-dhcp
1462is in effect.
Simon Kelleya9530962012-03-20 22:07:35 +00001463
Simon Kelley1adadf52012-02-13 22:15:58 +00001464For IPv4 only:
1465
1466DNSMASQ_CLIENT_ID if the host provided a client-id.
1467
Simon Kelleydd1721c2013-02-18 21:04:04 +00001468DNSMASQ_CIRCUIT_ID, DNSMASQ_SUBSCRIBER_ID, DNSMASQ_REMOTE_ID if a
1469DHCP relay-agent added any of these options.
1470
Simon Kelley1adadf52012-02-13 22:15:58 +00001471If the client provides vendor-class, DNSMASQ_VENDOR_CLASS.
1472
1473For IPv6 only:
1474
1475If the client provides vendor-class, DNSMASQ_VENDOR_CLASS_ID,
1476containing the IANA enterprise id for the class, and
1477DNSMASQ_VENDOR_CLASS0..DNSMASQ_VENDOR_CLASSn for the data.
1478
Simon Kelley57f460d2012-02-16 20:00:32 +00001479DNSMASQ_SERVER_DUID containing the DUID of the server: this is the same for
Simon Kelley1adadf52012-02-13 22:15:58 +00001480every call to the script.
1481
1482DNSMASQ_IAID containing the IAID for the lease. If the lease is a
1483temporary allocation, this is prefixed to 'T'.
1484
Simon Kelley89500e32013-09-20 16:29:20 +01001485DNSMASQ_MAC containing the MAC address of the client, if known.
Simon Kelley1adadf52012-02-13 22:15:58 +00001486
1487Note that the supplied hostname, vendorclass and userclass data is
1488only supplied for
1489"add" actions or "old" actions when a host resumes an existing lease,
1490since these data are not held in dnsmasq's lease
1491database.
1492
Simon Kelleya9530962012-03-20 22:07:35 +00001493
1494
Simon Kelley9e038942008-05-30 20:06:34 +01001495All file descriptors are
Simon Kelley7cebd202006-05-06 14:13:33 +01001496closed except stdin, stdout and stderr which are open to /dev/null
1497(except in debug mode).
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001498
1499The script is not invoked concurrently: at most one instance
1500of the script is ever running (dnsmasq waits for an instance of script to exit
1501before running the next). Changes to the lease database are which
1502require the script to be invoked are queued awaiting exit of a running instance.
1503If this queueing allows multiple state changes occur to a single
1504lease before the script can be run then
1505earlier states are discarded and the current state of that lease is
1506reflected when the script finally runs.
1507
1508At dnsmasq startup, the script will be invoked for
Simon Kelley7cebd202006-05-06 14:13:33 +01001509all existing leases as they are read from the lease file. Expired
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001510leases will be called with "del" and others with "old". When dnsmasq
Simon Kelley5aabfc72007-08-29 11:24:47 +01001511receives a HUP signal, the script will be invoked for existing leases
Simon Kelley9e038942008-05-30 20:06:34 +01001512with an "old " event.
Simon Kelleya9530962012-03-20 22:07:35 +00001513
1514
1515There are two further actions which may appear as the first argument
1516to the script, "init" and "tftp". More may be added in the future, so
1517scripts should be written to ignore unknown actions. "init" is
Simon Kelleye46164e2012-04-16 16:39:38 +01001518described below in
Simon Kelleya9530962012-03-20 22:07:35 +00001519.B --leasefile-ro
1520The "tftp" action is invoked when a TFTP file transfer completes: the
1521arguments are the file size in bytes, the address to which the file
1522was sent, and the complete pathname of the file.
1523
Simon Kelley9e038942008-05-30 20:06:34 +01001524.TP
Simon Kelley57f460d2012-02-16 20:00:32 +00001525.B --dhcp-luascript=<path>
1526Specify a script written in Lua, to be run when leases are created,
1527destroyed or changed. To use this option, dnsmasq must be compiled
1528with the correct support. The Lua interpreter is intialised once, when
1529dnsmasq starts, so that global variables persist between lease
1530events. The Lua code must define a
1531.B lease
1532function, and may provide
1533.B init
1534and
1535.B shutdown
1536functions, which are called, without arguments when dnsmasq starts up
Simon Kelleya9530962012-03-20 22:07:35 +00001537and terminates. It may also provide a
1538.B tftp
1539function.
Simon Kelley57f460d2012-02-16 20:00:32 +00001540
1541The
1542.B lease
Simon Kelleya9530962012-03-20 22:07:35 +00001543function receives the information detailed in
Simon Kelley57f460d2012-02-16 20:00:32 +00001544.B --dhcp-script.
1545It gets two arguments, firstly the action, which is a string
1546containing, "add", "old" or "del", and secondly a table of tag value
1547pairs. The tags mostly correspond to the environment variables
1548detailed above, for instance the tag "domain" holds the same data as
1549the environment variable DNSMASQ_DOMAIN. There are a few extra tags
1550which hold the data supplied as arguments to
1551.B --dhcp-script.
1552These are
1553.B mac_address, ip_address
1554and
1555.B hostname
1556for IPv4, and
1557.B client_duid, ip_address
1558and
1559.B hostname
Simon Kelleya9530962012-03-20 22:07:35 +00001560for IPv6.
1561
1562The
1563.B tftp
1564function is called in the same way as the lease function, and the
1565table holds the tags
1566.B destination_address,
1567.B file_name
1568and
1569.B file_size.
Simon Kelley57f460d2012-02-16 20:00:32 +00001570.TP
Simon Kelley9e038942008-05-30 20:06:34 +01001571.B --dhcp-scriptuser
Simon Kelley57f460d2012-02-16 20:00:32 +00001572Specify the user as which to run the lease-change script or Lua script. This defaults to root, but can be changed to another user using this flag.
Simon Kelley208b65c2006-08-05 21:41:37 +01001573.TP
1574.B \-9, --leasefile-ro
1575Completely suppress use of the lease database file. The file will not
1576be created, read, or written. Change the way the lease-change
1577script (if one is provided) is called, so that the lease database may
1578be maintained in external storage by the script. In addition to the
Simon Kelleyf2621c72007-04-29 19:47:21 +01001579invocations given in
Simon Kelley208b65c2006-08-05 21:41:37 +01001580.B --dhcp-script
1581the lease-change script is called once, at dnsmasq startup, with the
1582single argument "init". When called like this the script should write
1583the saved state of the lease database, in dnsmasq leasefile format, to
1584stdout and exit with zero exit code. Setting this
1585option also forces the leasechange script to be called on changes
1586to the client-id and lease length and expiry time.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001587.TP
Simon Kelley832af0b2007-01-21 20:01:28 +00001588.B --bridge-interface=<interface>,<alias>[,<alias>]
1589Treat DHCP request packets arriving at any of the <alias> interfaces
Simon Kelley7622fc02009-06-04 20:32:05 +01001590as if they had arrived at <interface>. This option is necessary when
1591using "old style" bridging on BSD platforms, since
Simon Kelley832af0b2007-01-21 20:01:28 +00001592packets arrive at tap interfaces which don't have an IP address.
Neil Jerram70772c92014-06-11 21:22:40 +01001593A trailing '*' wildcard can be used in each <alias>.
Simon Kelley832af0b2007-01-21 20:01:28 +00001594.TP
Simon Kelley28866e92011-02-14 20:19:14 +00001595.B \-s, --domain=<domain>[,<address range>[,local]]
Simon Kelley9009d742008-11-14 20:04:27 +00001596Specifies DNS domains for the DHCP server. Domains may be be given
1597unconditionally (without the IP range) or for limited IP ranges. This has two effects;
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001598firstly it causes the DHCP server to return the domain to any hosts
1599which request it, and secondly it sets the domain which it is legal
Simon Kelley1b7ecd12007-02-05 14:57:57 +00001600for DHCP-configured hosts to claim. The intention is to constrain
1601hostnames so that an untrusted host on the LAN cannot advertise
1602its name via dhcp as e.g. "microsoft.com" and capture traffic not
1603meant for it. If no domain suffix is specified, then any DHCP
1604hostname with a domain part (ie with a period) will be disallowed
1605and logged. If suffix is specified, then hostnames with a domain
1606part are allowed, provided the domain part matches the suffix. In
1607addition, when a suffix is set then hostnames without a domain
1608part have the suffix added as an optional domain part. Eg on my network I can set
Simon Kelley3d8df262005-08-29 12:19:27 +01001609.B --domain=thekelleys.org.uk
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001610and have a machine whose DHCP hostname is "laptop". The IP address for that machine is available from
1611.B dnsmasq
Simon Kelleyde379512004-06-22 20:23:33 +01001612both as "laptop" and "laptop.thekelleys.org.uk". If the domain is
1613given as "#" then the domain is read from the first "search" directive
Simon Kelley28866e92011-02-14 20:19:14 +00001614in /etc/resolv.conf (or equivalent).
1615
1616The address range can be of the form
Simon Kelley9009d742008-11-14 20:04:27 +00001617<ip address>,<ip address> or <ip address>/<netmask> or just a single
1618<ip address>. See
1619.B --dhcp-fqdn
1620which can change the behaviour of dnsmasq with domains.
Simon Kelley28866e92011-02-14 20:19:14 +00001621
1622If the address range is given as ip-address/network-size, then a
1623additional flag "local" may be supplied which has the effect of adding
1624--local declarations for forward and reverse DNS queries. Eg.
1625.B --domain=thekelleys.org.uk,192.168.0.0/24,local
1626is identical to
1627.B --domain=thekelleys.org.uk,192.168.0.0/24
1628--local=/thekelleys.org.uk/ --local=/0.168.192.in-addr.arpa/
1629The network size must be 8, 16 or 24 for this to be legal.
Simon Kelley9009d742008-11-14 20:04:27 +00001630.TP
1631.B --dhcp-fqdn
1632In the default mode, dnsmasq inserts the unqualified names of
1633DHCP clients into the DNS. For this reason, the names must be unique,
1634even if two clients which have the same name are in different
1635domains. If a second DHCP client appears which has the same name as an
Tomas Hozzaa66d36e2013-04-22 15:08:07 +01001636existing client, the name is transferred to the new client. If
Simon Kelley9009d742008-11-14 20:04:27 +00001637.B --dhcp-fqdn
1638is set, this behaviour changes: the unqualified name is no longer
1639put in the DNS, only the qualified name. Two DHCP clients with the
1640same name may both keep the name, provided that the domain part is
1641different (ie the fully qualified names differ.) To ensure that all
1642names have a domain part, there must be at least
1643.B --domain
1644without an address specified when
1645.B --dhcp-fqdn
1646is set.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001647.TP
Simon Kelleyc72daea2012-01-05 21:33:27 +00001648.B --dhcp-client-update
1649Normally, when giving a DHCP lease, dnsmasq sets flags in the FQDN
1650option to tell the client not to attempt a DDNS update with its name
1651and IP address. This is because the name-IP pair is automatically
1652added into dnsmasq's DNS view. This flag suppresses that behaviour,
1653this is useful, for instance, to allow Windows clients to update
1654Active Directory servers. See RFC 4702 for details.
1655.TP
Simon Kelleyc5ad4e72012-02-24 16:06:20 +00001656.B --enable-ra
1657Enable dnsmasq's IPv6 Router Advertisement feature. DHCPv6 doesn't
1658handle complete network configuration in the same way as DHCPv4. Router
1659discovery and (possibly) prefix discovery for autonomous address
1660creation are handled by a different protocol. When DHCP is in use,
1661only a subset of this is needed, and dnsmasq can handle it, using
1662existing DHCP configuration to provide most data. When RA is enabled,
1663dnsmasq will advertise a prefix for each dhcp-range, with default
1664router and recursive DNS server as the relevant link-local address on
Simon Kelleye8ca69e2012-03-26 21:23:26 +01001665the machine running dnsmasq. By default, he "managed address" bits are set, and
1666the "use SLAAC" bit is reset. This can be changed for individual
1667subnets with the mode keywords described in
1668.B --dhcp-range.
Simon Kelley18f0fb02012-03-31 21:18:55 +01001669RFC6106 DNS parameters are included in the advertisements. By default,
1670the relevant link-local address of the machine running dnsmasq is sent
1671as recursive DNS server. If provided, the DHCPv6 options dns-server and
1672domain-search are used for RDNSS and DNSSL.
Simon Kelleyc5ad4e72012-02-24 16:06:20 +00001673.TP
Simon Kelleyc4cd95d2013-10-10 20:58:11 +01001674.B --ra-param=<interface>,[high|low],[[<ra-interval>],<router lifetime>]
1675Set non-default values for router advertisements sent via an
1676interface. The priority field for the router may be altered from the
1677default of medium with eg
1678.B --ra-param=eth0,high.
1679The interval between router advertisements may be set (in seconds) with
1680.B --ra-param=eth0,60.
1681The lifetime of the route may be changed or set to zero, which allows
1682a router to advertise prefixes but not a route via itself.
1683.B --ra-parm=eth0,0,0
1684(A value of zero for the interval means the default value.) All three parameters may be set at once.
1685.B --ra-param=low,60,1200
1686The interface field may include a wildcard.
Simon Kelley8d030462013-07-29 15:41:26 +01001687.TP
Simon Kelley2937f8a2013-07-29 19:49:07 +01001688.B --enable-tftp[=<interface>[,<interface>]]
Simon Kelley832af0b2007-01-21 20:01:28 +00001689Enable the TFTP server function. This is deliberately limited to that
Simon Kelley9e038942008-05-30 20:06:34 +01001690needed to net-boot a client. Only reading is allowed; the tsize and
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001691blksize extensions are supported (tsize is only supported in octet
Simon Kelley2937f8a2013-07-29 19:49:07 +01001692mode). Without an argument, the TFTP service is provided to the same set of interfaces as DHCP service.
1693If the list of interfaces is provided, that defines which interfaces recieve TFTP service.
Simon Kelleyb8187c82005-11-26 21:46:27 +00001694.TP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001695.B --tftp-root=<directory>[,<interface>]
Simon Kelley832af0b2007-01-21 20:01:28 +00001696Look for files to transfer using TFTP relative to the given
1697directory. When this is set, TFTP paths which include ".." are
1698rejected, to stop clients getting outside the specified root.
Simon Kelleyf2621c72007-04-29 19:47:21 +01001699Absolute paths (starting with /) are allowed, but they must be within
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001700the tftp-root. If the optional interface argument is given, the
1701directory is only used for TFTP requests via that interface.
Simon Kelley832af0b2007-01-21 20:01:28 +00001702.TP
Simon Kelley5aabfc72007-08-29 11:24:47 +01001703.B --tftp-unique-root
1704Add the IP address of the TFTP client as a path component on the end
1705of the TFTP-root (in standard dotted-quad format). Only valid if a
1706tftp-root is set and the directory exists. For instance, if tftp-root is "/tftp" and client
17071.2.3.4 requests file "myfile" then the effective path will be
1708"/tftp/1.2.3.4/myfile" if /tftp/1.2.3.4 exists or /tftp/myfile otherwise.
1709.TP
Simon Kelley832af0b2007-01-21 20:01:28 +00001710.B --tftp-secure
Simon Kelley5aabfc72007-08-29 11:24:47 +01001711Enable TFTP secure mode: without this, any file which is readable by
Simon Kelley832af0b2007-01-21 20:01:28 +00001712the dnsmasq process under normal unix access-control rules is
1713available via TFTP. When the --tftp-secure flag is given, only files
1714owned by the user running the dnsmasq process are accessible. If
1715dnsmasq is being run as root, different rules apply: --tftp-secure
Simon Kelley1b7ecd12007-02-05 14:57:57 +00001716has no effect, but only files which have the world-readable bit set
Simon Kelley832af0b2007-01-21 20:01:28 +00001717are accessible. It is not recommended to run dnsmasq as root with TFTP
1718enabled, and certainly not without specifying --tftp-root. Doing so
1719can expose any world-readable file on the server to any host on the net.
1720.TP
Simon Kelley61ce6002012-04-20 21:28:49 +01001721.B --tftp-lowercase
1722Convert filenames in TFTP requests to all lowercase. This is useful
1723for requests from Windows machines, which have case-insensitive
1724filesystems and tend to play fast-and-loose with case in filenames.
1725Note that dnsmasq's tftp server always converts "\\" to "/" in filenames.
1726.TP
Simon Kelley832af0b2007-01-21 20:01:28 +00001727.B --tftp-max=<connections>
1728Set the maximum number of concurrent TFTP connections allowed. This
1729defaults to 50. When serving a large number of TFTP connections,
1730per-process file descriptor limits may be encountered. Dnsmasq needs
1731one file descriptor for each concurrent TFTP connection and one
1732file descriptor per unique file (plus a few others). So serving the
1733same file simultaneously to n clients will use require about n + 10 file
1734descriptors, serving different files simultaneously to n clients will
Simon Kelley824af852008-02-12 20:43:05 +00001735require about (2*n) + 10 descriptors. If
1736.B --tftp-port-range
1737is given, that can affect the number of concurrent connections.
Simon Kelley6b010842007-02-12 20:32:07 +00001738.TP
1739.B --tftp-no-blocksize
1740Stop the TFTP server from negotiating the "blocksize" option with a
1741client. Some buggy clients request this option but then behave badly
1742when it is granted.
Simon Kelley824af852008-02-12 20:43:05 +00001743.TP
1744.B --tftp-port-range=<start>,<end>
1745A TFTP server listens on a well-known port (69) for connection initiation,
1746but it also uses a dynamically-allocated port for each
1747connection. Normally these are allocated by the OS, but this option
1748specifies a range of ports for use by TFTP transfers. This can be
1749useful when TFTP has to traverse a firewall. The start of the range
1750cannot be lower than 1025 unless dnsmasq is running as root. The number
1751of concurrent TFTP connections is limited by the size of the port range.
Simon Kelley832af0b2007-01-21 20:01:28 +00001752.TP
Simon Kelleyb8187c82005-11-26 21:46:27 +00001753.B \-C, --conf-file=<file>
1754Specify a different configuration file. The conf-file option is also allowed in
Simon Kelley28866e92011-02-14 20:19:14 +00001755configuration files, to include multiple configuration files. A
1756filename of "-" causes dnsmasq to read configuration from stdin.
Simon Kelley849a8352006-06-09 21:02:31 +01001757.TP
Simon Kelley3e1551a2014-09-09 21:46:07 +01001758.B \-7, --conf-dir=<directory>[,<file-extension>......],
Simon Kelley849a8352006-06-09 21:02:31 +01001759Read all the files in the given directory as configuration
Simon Kelley1f15b812009-10-13 17:49:32 +01001760files. If extension(s) are given, any files which end in those
1761extensions are skipped. Any files whose names end in ~ or start with . or start and end
Simon Kelley3e1551a2014-09-09 21:46:07 +01001762with # are always skipped. If the extension starts with * then only files
1763which have that extension are loaded. So
1764.B --conf-dir=/path/to/dir,*.conf
1765loads all files with the suffix .conf in /path/to/dir. This flag may be given on the command
1766line or in a configuration file. If giving it on the command line, be sure to
1767escape * characters.
Simon Kelley7b1eae42014-02-20 13:43:28 +00001768.TP
1769.B --servers-file=<file>
1770A special case of
1771.B --conf-file
1772which differs in two respects. Firstly, only --server and --rev-server are allowed
1773in the configuration file included. Secondly, the file is re-read and the configuration
1774therein is updated when dnsmasq recieves SIGHUP.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001775.SH CONFIG FILE
Simon Kelley3be34542004-09-11 19:12:13 +01001776At startup, dnsmasq reads
1777.I /etc/dnsmasq.conf,
1778if it exists. (On
1779FreeBSD, the file is
1780.I /usr/local/etc/dnsmasq.conf
Simon Kelleyb8187c82005-11-26 21:46:27 +00001781) (but see the
1782.B \-C
Simon Kelley849a8352006-06-09 21:02:31 +01001783and
1784.B \-7
1785options.) The format of this
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001786file consists of one option per line, exactly as the long options detailed
1787in the OPTIONS section but without the leading "--". Lines starting with # are comments and ignored. For
Simon Kelleyb49644f2004-01-30 21:36:24 +00001788options which may only be specified once, the configuration file overrides
Simon Kelleyb8187c82005-11-26 21:46:27 +00001789the command line. Quoting is allowed in a config file:
Simon Kelley3d8df262005-08-29 12:19:27 +01001790between " quotes the special meanings of ,:. and # are removed and the
Simon Kelley824af852008-02-12 20:43:05 +00001791following escapes are allowed: \\\\ \\" \\t \\e \\b \\r and \\n. The later
1792corresponding to tab, escape, backspace, return and newline.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001793.SH NOTES
1794When it receives a SIGHUP,
1795.B dnsmasq
Simon Kelley3be34542004-09-11 19:12:13 +01001796clears its cache and then re-loads
Simon Kelley5aabfc72007-08-29 11:24:47 +01001797.I /etc/hosts
1798and
1799.I /etc/ethers
Simon Kelley3d04f462015-01-31 21:59:13 +00001800and any file given by --dhcp-hostsfile, --dhcp-hostsdir, --dhcp-optsfile,
1801--dhcp-optsdir, --addn-hosts or --hostsdir.
Simon Kelley5aabfc72007-08-29 11:24:47 +01001802The dhcp lease change script is called for all
1803existing DHCP leases. If
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001804.B
1805--no-poll
Simon Kelley3be34542004-09-11 19:12:13 +01001806is set SIGHUP also re-reads
1807.I /etc/resolv.conf.
1808SIGHUP
Simon Kelleyb49644f2004-01-30 21:36:24 +00001809does NOT re-read the configuration file.
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001810.PP
1811When it receives a SIGUSR1,
1812.B dnsmasq
Simon Kelley824af852008-02-12 20:43:05 +00001813writes statistics to the system log. It writes the cache size,
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001814the number of names which have had to removed from the cache before
1815they expired in order to make room for new names and the total number
Simon Kelleyfec216d2014-03-27 20:54:34 +00001816of names that have been inserted into the cache. The number of cache hits and
1817misses and the number of authoritative queries answered are also given. For each upstream
Simon Kelley824af852008-02-12 20:43:05 +00001818server it gives the number of queries sent, and the number which
1819resulted in an error. In
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001820.B --no-daemon
Simon Kelley5aabfc72007-08-29 11:24:47 +01001821mode or when full logging is enabled (-q), a complete dump of the
Simon Kelleyfec216d2014-03-27 20:54:34 +00001822contents of the cache is made.
1823
1824The cache statistics are also available in the DNS as answers to
1825queries of class CHAOS and type TXT in domain bind. The domain names are cachesize.bind, insertions.bind, evictions.bind,
1826misses.bind, hits.bind, auth.bind and servers.bind. An example command to query this, using the
1827.B dig
1828utility would be
1829
1830dig +short chaos txt cachesize.bind
1831
Simon Kelley5aabfc72007-08-29 11:24:47 +01001832.PP
1833When it receives SIGUSR2 and it is logging direct to a file (see
1834.B --log-facility
1835)
1836.B dnsmasq
1837will close and reopen the log file. Note that during this operation,
1838dnsmasq will not be running as root. When it first creates the logfile
1839dnsmasq changes the ownership of the file to the non-root user it will run
1840as. Logrotate should be configured to create a new log file with
Simon Kelley9e038942008-05-30 20:06:34 +01001841the ownership which matches the existing one before sending SIGUSR2.
Simon Kelley5aabfc72007-08-29 11:24:47 +01001842If TCP DNS queries are in progress, the old logfile will remain open in
1843child processes which are handling TCP queries and may continue to be
1844written. There is a limit of 150 seconds, after which all existing TCP
1845processes will have expired: for this reason, it is not wise to
1846configure logfile compression for logfiles which have just been
1847rotated. Using logrotate, the required options are
1848.B create
1849and
1850.B delaycompress.
1851
1852
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001853.PP
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001854Dnsmasq is a DNS query forwarder: it it not capable of recursively
1855answering arbitrary queries starting from the root servers but
1856forwards such queries to a fully recursive upstream DNS server which is
1857typically provided by an ISP. By default, dnsmasq reads
Simon Kelley3be34542004-09-11 19:12:13 +01001858.I /etc/resolv.conf
1859to discover the IP
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001860addresses of the upstream nameservers it should use, since the
1861information is typically stored there. Unless
1862.B --no-poll
1863is used,
1864.B dnsmasq
Simon Kelley3be34542004-09-11 19:12:13 +01001865checks the modification time of
1866.I /etc/resolv.conf
1867(or equivalent if
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001868.B \--resolv-file
1869is used) and re-reads it if it changes. This allows the DNS servers to
1870be set dynamically by PPP or DHCP since both protocols provide the
1871information.
Simon Kelley3be34542004-09-11 19:12:13 +01001872Absence of
1873.I /etc/resolv.conf
1874is not an error
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001875since it may not have been created before a PPP connection exists. Dnsmasq
Simon Kelley3be34542004-09-11 19:12:13 +01001876simply keeps checking in case
1877.I /etc/resolv.conf
1878is created at any
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001879time. Dnsmasq can be told to parse more than one resolv.conf
1880file. This is useful on a laptop, where both PPP and DHCP may be used:
Simon Kelley3be34542004-09-11 19:12:13 +01001881dnsmasq can be set to poll both
1882.I /etc/ppp/resolv.conf
1883and
1884.I /etc/dhcpc/resolv.conf
1885and will use the contents of whichever changed
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001886last, giving automatic switching between DNS servers.
1887.PP
1888Upstream servers may also be specified on the command line or in
Simon Kelleyb49644f2004-01-30 21:36:24 +00001889the configuration file. These server specifications optionally take a
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001890domain name which tells dnsmasq to use that server only to find names
1891in that particular domain.
1892.PP
1893In order to configure dnsmasq to act as cache for the host on which it is running, put "nameserver 127.0.0.1" in
1894.I /etc/resolv.conf
1895to force local processes to send queries to
1896dnsmasq. Then either specify the upstream servers directly to dnsmasq
1897using
1898.B \--server
1899options or put their addresses real in another file, say
1900.I /etc/resolv.dnsmasq
1901and run dnsmasq with the
1902.B \-r /etc/resolv.dnsmasq
1903option. This second technique allows for dynamic update of the server
1904addresses by PPP or DHCP.
Simon Kelley3be34542004-09-11 19:12:13 +01001905.PP
Simon Kelleyf6b7dc42005-01-23 12:06:08 +00001906Addresses in /etc/hosts will "shadow" different addresses for the same
1907names in the upstream DNS, so "mycompany.com 1.2.3.4" in /etc/hosts will ensure that
1908queries for "mycompany.com" always return 1.2.3.4 even if queries in
1909the upstream DNS would otherwise return a different address. There is
1910one exception to this: if the upstream DNS contains a CNAME which
1911points to a shadowed name, then looking up the CNAME through dnsmasq
1912will result in the unshadowed address associated with the target of
1913the CNAME. To work around this, add the CNAME to /etc/hosts so that
1914the CNAME is shadowed too.
1915
1916.PP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001917The tag system works as follows: For each DHCP request, dnsmasq
1918collects a set of valid tags from active configuration lines which
1919include set:<tag>, including one from the
Simon Kelley26128d22004-11-14 16:43:54 +00001920.B dhcp-range
1921used to allocate the address, one from any matching
1922.B dhcp-host
Simon Kelley9009d742008-11-14 20:04:27 +00001923(and "known" if a dhcp-host matches)
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001924The tag "bootp" is set for BOOTP requests, and a tag whose name is the
1925name of the interface on which the request arrived is also set.
1926
Tomas Hozzaa66d36e2013-04-22 15:08:07 +01001927Any configuration lines which include one or more tag:<tag> constructs
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001928will only be valid if all that tags are matched in the set derived
1929above. Typically this is dhcp-option.
Simon Kelley26128d22004-11-14 16:43:54 +00001930.B dhcp-option
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001931which has tags will be used in preference to an untagged
Simon Kelley26128d22004-11-14 16:43:54 +00001932.B dhcp-option,
1933provided that _all_ the tags match somewhere in the
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001934set collected as described above. The prefix '!' on a tag means 'not'
Moritz Warninge62e9b62014-03-20 15:32:22 +00001935so --dhcp-option=tag:!purple,3,1.2.3.4 sends the option when the
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001936tag purple is not in the set of valid tags. (If using this in a
1937command line rather than a configuration file, be sure to escape !,
1938which is a shell metacharacter)
Simon Kelley7de060b2011-08-26 17:24:52 +01001939
1940When selecting dhcp-options, a tag from dhcp-range is second class
1941relative to other tags, to make it easy to override options for
1942individual hosts, so
1943.B dhcp-range=set:interface1,......
1944.B dhcp-host=set:myhost,.....
1945.B dhcp-option=tag:interface1,option:nis-domain,"domain1"
1946.B dhcp-option=tag:myhost,option:nis-domain,"domain2"
1947will set the NIS-domain to domain1 for hosts in the range, but
1948override that to domain2 for a particular host.
1949
Simon Kelley26128d22004-11-14 16:43:54 +00001950.PP
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001951Note that for
Simon Kelleyf6b7dc42005-01-23 12:06:08 +00001952.B dhcp-range
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001953both tag:<tag> and set:<tag> are allowed, to both select the range in
1954use based on (eg) dhcp-host, and to affect the options sent, based on
1955the range selected.
1956
1957This system evolved from an earlier, more limited one and for backward
1958compatibility "net:" may be used instead of "tag:" and "set:" may be
1959omitted. (Except in
1960.B dhcp-host,
1961where "net:" may be used instead of "set:".) For the same reason, '#'
1962may be used instead of '!' to indicate NOT.
Simon Kelleyf6b7dc42005-01-23 12:06:08 +00001963.PP
Simon Kelley3be34542004-09-11 19:12:13 +01001964The DHCP server in dnsmasq will function as a BOOTP server also,
1965provided that the MAC address and IP address for clients are given,
1966either using
1967.B dhcp-host
1968configurations or in
1969.I /etc/ethers
1970, and a
1971.B dhcp-range
1972configuration option is present to activate the DHCP server
Simon Kelleyb8187c82005-11-26 21:46:27 +00001973on a particular network. (Setting --bootp-dynamic removes the need for
1974static address mappings.) The filename
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001975parameter in a BOOTP request is used as a tag,
1976as is the tag "bootp", allowing some control over the options returned to
Simon Kelley3be34542004-09-11 19:12:13 +01001977different classes of hosts.
1978
Simon Kelley333b2ce2013-01-07 21:46:03 +00001979.SH AUTHORITATIVE CONFIGURATION
1980.PP
1981Configuring dnsmasq to act as an authoritative DNS server is
1982complicated by the fact that it involves configuration of external DNS
1983servers to provide delegation. We will walk through three scenarios of
1984increasing complexity. Prerequisites for all of these scenarios
Simon Kelley81925ab2013-04-10 11:43:58 +01001985are a globally accessible IP address, an A or AAAA record pointing to that address,
Simon Kelley333b2ce2013-01-07 21:46:03 +00001986and an external DNS server capable of doing delegation of the zone in
1987question. For the first part of this explanation, we will call the A (or AAAA) record
1988for the globally accessible address server.example.com, and the zone
1989for which dnsmasq is authoritative our.zone.com.
1990
1991The simplest configuration consists of two lines of dnsmasq configuration; something like
1992
1993.nf
1994.B auth-server=server.example.com,eth0
Simon Kelley79cb46c2013-01-23 19:49:21 +00001995.B auth-zone=our.zone.com,1.2.3.0/24
Simon Kelley333b2ce2013-01-07 21:46:03 +00001996.fi
1997
1998and two records in the external DNS
1999
2000.nf
2001server.example.com A 192.0.43.10
2002our.zone.com NS server.example.com
2003.fi
2004
2005eth0 is the external network interface on which dnsmasq is listening,
2006and has (globally accessible) address 192.0.43.10.
2007
2008Note that the external IP address may well be dynamic (ie assigned
2009from an ISP by DHCP or PPP) If so, the A record must be linked to this
2010dynamic assignment by one of the usual dynamic-DNS systems.
2011
2012A more complex, but practically useful configuration has the address
2013record for the globally accessible IP address residing in the
2014authoritative zone which dnsmasq is serving, typically at the root. Now
2015we have
2016
2017.nf
2018.B auth-server=our.zone.com,eth0
Simon Kelley79cb46c2013-01-23 19:49:21 +00002019.B auth-zone=our.zone.com,1.2.3.0/24
Simon Kelley333b2ce2013-01-07 21:46:03 +00002020.fi
2021
2022.nf
Simon Kelley0f128eb2013-03-11 21:21:35 +00002023our.zone.com A 1.2.3.4
Simon Kelley333b2ce2013-01-07 21:46:03 +00002024our.zone.com NS our.zone.com
2025.fi
2026
2027The A record for our.zone.com has now become a glue record, it solves
2028the chicken-and-egg problem of finding the IP address of the
2029nameserver for our.zone.com when the A record is within that
2030zone. Note that this is the only role of this record: as dnsmasq is
2031now authoritative from our.zone.com it too must provide this
2032record. If the external address is static, this can be done with an
2033.B /etc/hosts
2034entry or
2035.B --host-record.
Simon Kelley333b2ce2013-01-07 21:46:03 +00002036
2037.nf
Simon Kelley0f128eb2013-03-11 21:21:35 +00002038.B auth-server=our.zone.com,eth0
2039.B host-record=our.zone.com,1.2.3.4
2040.B auth-zone=our.zone.com,1.2.3.0/24
2041.fi
2042
2043If the external address is dynamic, the address
2044associated with our.zone.com must be derived from the address of the
Simon Kelley6f130de2013-04-15 14:47:14 +01002045relevant interface. This is done using
Simon Kelley0f128eb2013-03-11 21:21:35 +00002046.B interface-name
2047Something like:
2048
2049.nf
2050.B auth-server=our.zone.com,eth0
2051.B interface-name=our.zone.com,eth0
Simon Kelley32b4e4c2013-11-14 10:36:55 +00002052.B auth-zone=our.zone.com,1.2.3.0/24,eth0
Simon Kelley333b2ce2013-01-07 21:46:03 +00002053.fi
2054
Simon Kelley32b4e4c2013-11-14 10:36:55 +00002055(The "eth0" argument in auth-zone adds the subnet containing eth0's
2056dynamic address to the zone, so that the interface-name returns the
2057address in outside queries.)
2058
Simon Kelley333b2ce2013-01-07 21:46:03 +00002059Our final configuration builds on that above, but also adds a
2060secondary DNS server. This is another DNS server which learns the DNS data
2061for the zone by doing zones transfer, and acts as a backup should
2062the primary server become inaccessible. The configuration of the
2063secondary is beyond the scope of this man-page, but the extra
2064configuration of dnsmasq is simple:
2065
2066.nf
2067.B auth-sec-servers=secondary.myisp.com
2068.fi
2069
2070and
2071
2072.nf
2073our.zone.com NS secondary.myisp.com
2074.fi
2075
2076Adding auth-sec-servers enables zone transfer in dnsmasq, to allow the
2077secondary to collect the DNS data. If you wish to restrict this data
2078to particular hosts then
2079
2080.nf
2081.B auth-peer=<IP address of secondary>
2082.fi
2083
2084will do so.
2085
2086Dnsmasq acts as an authoritative server for in-addr.arpa and
Lutz Preßler1d7e0a32014-04-07 22:06:23 +01002087ip6.arpa domains associated with the subnets given in auth-zone
Simon Kelley333b2ce2013-01-07 21:46:03 +00002088declarations, so reverse (address to name) lookups can be simply
2089configured with a suitable NS record, for instance in this example,
2090where we allow 1.2.3.0/24 addresses.
2091
2092.nf
2093 3.2.1.in-addr.arpa NS our.zone.com
2094.fi
2095
2096Note that at present, reverse (in-addr.arpa and ip6.arpa) zones are
2097not available in zone transfers, so there is no point arranging
2098secondary servers for reverse lookups.
2099
2100.PP
2101When dnsmasq is configured to act as an authoritative server, the
2102following data is used to populate the authoritative zone.
2103.PP
2104.B --mx-host, --srv-host, --dns-rr, --txt-record, --naptr-record
2105, as long as the record names are in the authoritative domain.
2106.PP
2107.B --cname
2108as long as the record name is in the authoritative domain. If the
2109target of the CNAME is unqualified, then it is qualified with the
2110authoritative zone name.
2111.PP
2112IPv4 and IPv6 addresses from /etc/hosts (and
2113.B --addn-hosts
2114) and
2115.B --host-record
Simon Kelley376d48c2013-11-13 13:04:30 +00002116and
2117.B --interface-name
Simon Kelley333b2ce2013-01-07 21:46:03 +00002118provided the address falls into one of the subnets specified in the
2119.B --auth-zone.
2120.PP
Simon Kelley333b2ce2013-01-07 21:46:03 +00002121Addresses of DHCP leases, provided the address falls into one of the subnets specified in the
Simon Kelley376d48c2013-11-13 13:04:30 +00002122.B --auth-zone.
2123(If contructed DHCP ranges are is use, which depend on the address dynamically
2124assigned to an interface, then the form of
Simon Kelley333b2ce2013-01-07 21:46:03 +00002125.B --auth-zone
Simon Kelley376d48c2013-11-13 13:04:30 +00002126which defines subnets by the dynamic address of an interface should
2127be used to ensure this condition is met.)
2128.PP
2129In the default mode, where a DHCP lease
Simon Kelley333b2ce2013-01-07 21:46:03 +00002130has an unqualified name, and possibly a qualified name constructed
2131using
2132.B --domain
2133then the name in the authoritative zone is constructed from the
2134unqualified name and the zone's domain. This may or may not equal
2135that specified by
2136.B --domain.
2137If
2138.B --dhcp-fqdn
2139is set, then the fully qualified names associated with DHCP leases are
2140used, and must match the zone's domain.
2141
2142
2143
Simon Kelley5aabfc72007-08-29 11:24:47 +01002144.SH EXIT CODES
2145.PP
21460 - Dnsmasq successfully forked into the background, or terminated
2147normally if backgrounding is not enabled.
2148.PP
21491 - A problem with configuration was detected.
2150.PP
21512 - A problem with network access occurred (address in use, attempt
2152to use privileged ports without permission).
2153.PP
Simon Kelley9e038942008-05-30 20:06:34 +010021543 - A problem occurred with a filesystem operation (missing
Simon Kelley5aabfc72007-08-29 11:24:47 +01002155file/directory, permissions).
2156.PP
21574 - Memory allocation failure.
2158.PP
21595 - Other miscellaneous problem.
2160.PP
216111 or greater - a non zero return code was received from the
2162lease-script process "init" call. The exit code from dnsmasq is the
2163script's exit code with 10 added.
2164
Simon Kelley1b7ecd12007-02-05 14:57:57 +00002165.SH LIMITS
2166The default values for resource limits in dnsmasq are generally
2167conservative, and appropriate for embedded router type devices with
2168slow processors and limited memory. On more capable hardware, it is
2169possible to increase the limits, and handle many more clients. The
2170following applies to dnsmasq-2.37: earlier versions did not scale as well.
2171
2172.PP
2173Dnsmasq is capable of handling DNS and DHCP for at least a thousand
Simon Kelley8ef5ada2010-06-03 19:42:45 +01002174clients. The DHCP lease times should not be very short (less than one hour). The
Simon Kelley1b7ecd12007-02-05 14:57:57 +00002175value of
2176.B --dns-forward-max
2177can be increased: start with it equal to
2178the number of clients and increase if DNS seems slow. Note that DNS
2179performance depends too on the performance of the upstream
2180nameservers. The size of the DNS cache may be increased: the hard
2181limit is 10000 names and the default (150) is very low. Sending
2182SIGUSR1 to dnsmasq makes it log information which is useful for tuning
2183the cache size. See the
2184.B NOTES
2185section for details.
2186
2187.PP
2188The built-in TFTP server is capable of many simultaneous file
2189transfers: the absolute limit is related to the number of file-handles
2190allowed to a process and the ability of the select() system call to
2191cope with large numbers of file handles. If the limit is set too high
2192using
2193.B --tftp-max
2194it will be scaled down and the actual limit logged at
2195start-up. Note that more transfers are possible when the same file is
2196being sent than when each transfer sends a different file.
2197
2198.PP
2199It is possible to use dnsmasq to block Web advertising by using a list
2200of known banner-ad servers, all resolving to 127.0.0.1 or 0.0.0.0, in
2201.B /etc/hosts
2202or an additional hosts file. The list can be very long,
2203dnsmasq has been tested successfully with one million names. That size
2204file needs a 1GHz processor and about 60Mb of RAM.
2205
Simon Kelley1f15b812009-10-13 17:49:32 +01002206.SH INTERNATIONALISATION
2207Dnsmasq can be compiled to support internationalisation. To do this,
2208the make targets "all-i18n" and "install-i18n" should be used instead of
2209the standard targets "all" and "install". When internationalisation
2210is compiled in, dnsmasq will produce log messages in the local
2211language and support internationalised domain names (IDN). Domain
2212names in /etc/hosts, /etc/ethers and /etc/dnsmasq.conf which contain
2213non-ASCII characters will be translated to the DNS-internal punycode
2214representation. Note that
2215dnsmasq determines both the language for messages and the assumed
2216charset for configuration
2217files from the LANG environment variable. This should be set to the system
2218default value by the script which is responsible for starting
2219dnsmasq. When editing the configuration files, be careful to do so
2220using only the system-default locale and not user-specific one, since
2221dnsmasq has no direct way of determining the charset in use, and must
2222assume that it is the system default.
2223
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002224.SH FILES
Simon Kelleyb49644f2004-01-30 21:36:24 +00002225.IR /etc/dnsmasq.conf
2226
2227.IR /usr/local/etc/dnsmasq.conf
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002228
2229.IR /etc/resolv.conf
Simon Kelley28866e92011-02-14 20:19:14 +00002230.IR /var/run/dnsmasq/resolv.conf
2231.IR /etc/ppp/resolv.conf
2232.IR /etc/dhcpc/resolv.conf
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002233
2234.IR /etc/hosts
2235
Simon Kelley3be34542004-09-11 19:12:13 +01002236.IR /etc/ethers
2237
Simon Kelleyb49644f2004-01-30 21:36:24 +00002238.IR /var/lib/misc/dnsmasq.leases
2239
2240.IR /var/db/dnsmasq.leases
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002241
2242.IR /var/run/dnsmasq.pid
2243.SH SEE ALSO
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002244.BR hosts (5),
2245.BR resolver (5)
2246.SH AUTHOR
2247This manual page was written by Simon Kelley <simon@thekelleys.org.uk>.
2248
2249