This website uses cookies. Enable dnsmasq to do PTR requests. Makefile 42.6%; Shell 30.0%; JavaScript 20.4%; Lua 7.0%; Footer OK, thank you, we are not first ones. I have defined the youtube ipset rule in mwan3 to go out wan1. I assume you have the mwan3 config rule set - it'll be similar to this is guess: config rule 'youtube' Disable rebind protection. option match 'src_ip'. Do you have any knowledge regarding mwan3 creating the ipsets? Also, ipsets can be created automatically from "/etc/config/network". The domain names that should feed into the IP sets are added in /etc/config/dhcp: Note that each domain name feeds into both IP sets for IPv4 and IPv6. Description: By clicking Sign up for GitHub, you agree to our terms of service and GPL-3.0 license Stars. E.g. There is a setting on Tools / Other Settings to change this behavior. Else extract and look through a router backup archive in a similar manner. Assuming you have access to your working system, I'd start by grepping through for 'ipset' and/or some of your set names and see what turns up. Usage Can somebody post on where to set the ipset aliases? Filtering web sites using firewall IP sets | devsaurus.github.io OK, but the question is how to create ipset by name, not just by list of IP's. When you define an ipset in the dhcp config file, dnsmasq doesn't add the set to the ipset list. Also you acknowledge that you have read and understand our Privacy Policy. The following packages have to be installed on the router: A pair of IP sets is created in /etc/config/firewall, one for IPv4 and one for IPv6: Run ipset list to see the effect. By using the website, you agree with storing cookies on your computer. $(sed -e "/${IPSET_FAMILY/ipv6/\\. The concept is to instruct the DNS name resolver to collect IP addresses that were obtained for certain domain names in IP sets. dnsmasq will not create the ipset itself. There are now two packages of this service available: pbr-iptables which supports fw3, iptables, ipset and dnsmasq.ipset option; pbr which supports fw4, nft, nft sets and dnsmasq.nftset option (but because OpenWrt's dnsmasq doesn't support nft sets yet, you can't use dnsmasq to resolve domain names from . Export to GitHub autovpn-for-openwrt - Dnsmasq_Ipset.wiki. dnsmasq-full add ipset support in dnsmasq.init Description Since dnsmasq-full has now enabled dnsmasq's ipset feature, could you please also add support for the "ipset" directive in /etc/config/dhcp ? The approach combines two mechanisms: This allows to filter for domain names that resolve dynamically to different IP addresses. https://openwrt.org/docs/guide-user/firewall/fw3_configurations/fw3_parent_controls. If you do not agree leave the website. dnsmasq's ipsets work fine for me. Features * Create and populate IP sets with domains, CIDRs and ASNs. # 3. how to make dnsmasq and ipset affect router? | SmallNetBuilder Forums I tested this by setting a DNS on my OpenWrt router and using 'dnsleaktest.com' to see what DNSs have been picked up. All the tests are being done on LEDE trunk on a Linksys EA8500. dnsmasq: ipset not filled Issue #6149 openwrt/packages option family 'ipv4' option storage 'hash' --ipset=/[/]/[,] Could you try to go to web-sites in ipset, and see, whether dnsmasq fills it? Similarly, even going back as far as Jan 2013, I can find no evidence that the dnsmasq init script created the ipsets, and hence dnsmasq's behaviour is as per documentation in that it needs the sets created before it will populate them. You will also need to create a subnet set file. option sticky 1' '${IPSET_NAME}'.family='${IPSET_FAMILY}' del_list firewall. could you give a command for domain matched? option use_policy 'balanced'. #16839 (dnsmasq-full add ipset support in dnsmasq.init) - OpenWrt Maybe you should remove dnsmasq, and install dnsmasq-full. Move dnsmasq to port 54. ex: ipset=/pandora.com/usvpn, https://openwrt.org/docs/guide-user/firewall/fw3_configurations/dns_ipset, Powered by Discourse, best viewed with JavaScript enabled, https://forum.openwrt.org/t/mwan3-rules-with-ipset, https://bugs.openwrt.org/index.php?do=details&task_id=1575, https://openwrt.org/docs/guide-user/firewall/fw3_configurations/fw3_parent_controls. Anything particular i should look out for? option dest_port '80,443' However mwan3 rules does not show my rule, I have banip as well as e2guardian packages installed. #2. Policy-Based Routing Statement about OpenWrt 22.03. release and this package. Are the instructions on the wiki out of date? # 5. I dont understand why dnsmasq is trying to get an dhcp lease when starting it. 4 watching Forks. As expected I was using the DNS set in OpenWrt. These IP sets must already exist. With the setup shown above, traffic to example.com and example.org is blocked even if the domain names resolve dynamically to different IP addresses. This works for me with an OpenVPN connection for routing certain addresses of visitors through a VPN. The issue is elsewhere. DNSMASQ can add IP addresses to an IPSET when certain domain names are queried: 518 #check for an already active dhcp server on the interface, unless 'force' is set The text was updated successfully, but these errors were encountered: Confirmed also on an Archer C7. and BSD-based (FreeBSD/Mac OS X/etc.) I use DHCP on opewrt router so the DNS is served by router or not? [OpenWrt Wiki] IP set extras Mwan3 rules with ipset - Network and Wireless Configuration - OpenWrt Forum A pair of filter rules is created in /etc/config/firewall, again one for IPv4 and one for IPv6: See DNS-based firewall with IP sets -> Extras for further tweaking of the firewall rules. dnsmasq-full Version: 2.85-8 Description: It is intended to provide coupled DNS and DHCP service to a LAN.\\ \\ This is a fully configurable variant with DHCPv4, DHCPv6, DNSSEC, Authoritative DNS\\ and IPset, Conntrack support & NO_ID enabled by default.\\ \\ Installed size: 178kB Dependencies: This is more modular than enabling these features for everyone. set firewall. The key is that the ipset must be manually added (/etc/rc.local for example). I have installed the full dnsmasq package. Really? Welcome to docs.openwrt.melmac.net! '${IPSET_NAME}'.entry='\0'/" "${IPSET_TEMP}") Put the setting in / etc / config / firewall. # 4. Domains and subdomains are matched in the same way as --address. Before, in OpenWRT CC 15.05 on a Archer C7 everything was working correctly. Languages. *$/\ OpenWRT is used to implement the concept. privacy statement. git.openwrt.org Git - openwrt/openwrt.git/blob - package/network But because I don't know if it's a developer known issue I post my results. '${IPSET_NAME}'.entry dnsmasq - How to block DNS over HTTPS using IPtables - Server Fault system. No, we've stuck at the same point: dnsmasq doesn't fill ipset. '${IPSET_NAME}'='ipset' Should we perform a futher test? IP set extras This article relies on the following: * Accessing OpenWrt CLI * Managing configurations * Managing packages * Managing services Introduction * This instruction extends the functionality of IP sets. By using the website, you agree with storing cookies on your computer. if you use ipset create hash:ip it correctlys begins to fill them. OpenWrt LuCI for ipset feature of DNSmasq-full Resources. Reduce dnsmasq cache size as it will only provide PTR/rDNS info. See ipset(8) for more details. option enabled '1' So 'ipset list' shows up a huge list. Ipsets can be created in /etc/config/firewall something like, config ipset I am using this feature together with mwan3 that has been heavily modified from CC 15.05 maybe was mwan3 that created the ipsets? set firewall. Welcome to docs.openwrt.melmac.net! | Documentation site for stangri's Except where otherwise noted, content on this wiki is licensed under the following license:CC Attribution-Share Alike 4.0 International, This instruction extends the functionality of. /${IPSET_FAMILY/ipv4/:}/d;s/^. Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International But this doesn't explain why it was working in CC 15.05. option timeout 300' I run traceroute from PC but it just show the openwrt router ip as hop: traceroute to xxxxxxx.com (85.114.x.x), 64 hops max 1 192.168.2.1 0,450ms 0,341ms 0,317ms 2 10.161.xxx.xx 187,092ms 214,425ms 285,287ms 3 10.205.xxx.xx 159,821ms 250,059ms 241,358ms .. You signed in with another tab or window. Hello! Dnsmasq is free software, and you are welcome to redistribute it under the terms of the GNU General Public License, version 2 or 3. --- a/package/network/services/dnsmasq/files/dnsmasq.init +++ b/package/network/services/dnsmasq/files/dnsmasq.init Note that they dont contain any members yet. Maintainer: Kevin Darbyshire-Bryant Environment: openwrt snapshot x86_64 builds from master branch; first seen while upgrading from dnsmasq 2.79 to 2.80test2 running on Hyper-V VM on amdfam10 Prozessor. delete firewall. Self-registration in the wiki has been disabled. option proto 'tcp' I declared in /etc/config/dhcp under dnsmasq. The configuration generated for dnsmasq correctly contains the ipset, but when you use ipset list to see them you don't see them. * Follow the automated section for quick setup. to your account. However following yields nothing. All the tests are being done on LEDE trunk on a Linksys EA8500. You should have these binaries on you system. There was an error obtaining wiki data: {"data":{"text":null},"status":-1,"config":{"method":"GET . When you define an ipset in the dhcp config file, dnsmasq doesn't add the set to the ipset list. I tried to set ipset alias in /etc/dnsmasq.conf file and my dhcp server stopped working. Contributors 2 . In both case the package dnsmasq-full has been installed to substitute dnsmasq. If you want to contribute to the OpenWrt wiki, please post HERE in the forum or ask on IRC for access. What I see is that the ipset is correctly managed by dnsmasq and filled IF IT EXISTS. Question to developers. Please use ipset-dns in connection with dnsmasq. This website uses cookies. The router won't use dnsmasq for DNS lookups by default. Beyond a quick look at the code and a 'google' a few minutes ago I've no mwan3 knowledge. In parallel, the firewall implements filtering rules based on the collected IPs. Except where otherwise noted, content on this wiki is licensed under the following license:CC Attribution-Share Alike 4.0 International. In both case the package dnsmasq-full has been installed to . 12 forks Releases 1. v0.0.3 Latest Aug 15, 2020. This is not the case with CC 15.05. I further checked the binary built and it includes all the things I would expect. [OpenWrt Wiki] AdGuard Home '${IPSET_NAME}'.name='${IPSET_NAME}' add_list firewall. Instead in CC 15.05 it was also creating it. Pre-conditions The following packages have to be installed on the router: opkg update # remove the pre-installed basic dnsmasq opkg remove dnsmasq opkg install dnsmasq-full ipset Firewall setup IP sets Please, give log after restarting of dnsmasq. Troubles with ipset and dnsmasq after update to 21.02.3 #9783 - GitHub Tue Nov 15 12:40:25 2016 daemon.crit dnsmasq[9415]: recompile with HAVE_IPSET defined to enable ipset directives at line 14 of /var/etc/dnsmasq.conf.cfg02411c. Before, in OpenWRT CC 15.05 on a Archer C7 everything was working correctly. Export to GitHub autovpn-for-openwrt - Dnsmasq_Ipset.wiki. Working on both Linux-based (Debian/Ubuntu/Cent OS/OpenWrt/LEDE/Cygwin/Bash on Windows/etc.) '${IPSET_NAME}'.match='net' Sorry, were it you, who asked me the same question a month ago? The following chapters are inspired by DNS-based firewall with IP sets. Did someone clean up the build rules for this and cut it out by mistake? If multiple setnames are given, then the addresses are placed in each of them, subject to the limitations of an IP set (IPv4 addresses cannot be stored in an IPv6 IP set and vice versa). GitHub - cokebar/gfwlist2dnsmasq: A shell script which convert gfwlist That thread: https://forum.openwrt.org/t/mwan3-rules-with-ipset, There is bug filed for dnsmasq https://bugs.openwrt.org/index.php?do=details&task_id=1575. Self-registration in the wiki has been disabled. OpenWRT is used to implement the concept. Packages 0. Also you acknowledge that you have read and understand our Privacy Policy. }/d FS#269 - dnsmasq-full doesn't set ipsets #5337 - GitHub Perhaps my answer is not entirely about your problem. #14654 (dnsmasq doesn't support ipset) - OpenWrt There was an error obtaining wiki data: {"data":{"text":null},"status":-1,"config":{"method":"GET . [OpenWrt Wiki] package: dnsmasq-full GitHub - lvqier/luci-app-dnsmasq-ipset: OpenWrt LuCI for ipset feature option name 'hulu' My dnsmasq file looks like so. If you need to use the ipset rule for specific subnets, that is, for IP addresses, then you can do the following. Oct 23, 2019. It looks as follows: In the file, each subnet begins with a new line. EOI, << EOI Also, it would be interesting to see your config files. set firewall. I've just checked on my build and the 'dnsmasq-full' build option selects dhcpv6, dnssec, auth dns, ipset, conntrack & no_id by default. Already on GitHub? Filtered DNS service responses from blocked domains are 0.0.0.0 which causes dnsmasq to fill the system log with possible DNS-rebind attack detected messages. Hi there, I know dnsmasq is currently in testing state. [OpenWrt Wiki] ipset-dns # ipset --version ipset v7.6, protocol version: 7 # uname -a Linux OpenWrt 5.4.188 #0 Sat Apr 16 12:59:34 2022 mips GNU/Linux Mwan3 and ipset - Network and Wireless Configuration - OpenWrt Forum Readme License. Places the resolved IP addresses of queries for one or more domains in the specified Netfilter IP set. option ipset 'youtube' Sign in Wan: Use local caching DNS server as system resolver (default: No). This script needs sed, base64, curl (or wget ). If you want to contribute to the OpenWrt wiki, please post HERE in the forum or ask on IRC for access. It correctly configure itself to manage it. VPN Bypass Statement about OpenWrt 22.03. release and this package TLDR: Even tho this package depends on iptables/ipset and dnsmasq support for ipset, it works just fine with recently released OpenWrt 22.03.. You can safely ignore the warning on the Status -> Firewall page about legacy iptables rules created by this package. We can safely say that dnsmasq is not the problem and is working correctly. This article shows a practical approach for how to filter web sites at your router. If you want to contribute to the OpenWrt wiki, please post HERE in the forum or ask on IRC for access. autovpn-for-openwrt - Dnsmasq_Ipset.wiki - Google autovpn-for-openwrt - Dnsmasq_Ipset.wiki - Google Next, on Windows I set a manual DNS, different to the openwrt one and did the test again on 'dnsleaktest.com' and started to see some of the overridden DNSs show up. CC Attribution-Share Alike 4.0 International. If you do not agree leave the website. The following chapters are inspired by DNS-based firewall with IP sets. This approach seems much more complex to me, surely just enabling a feature that's already present in dnsmasq is much easier than using a completely separate mechanism and having to point dnsmasq at it! << EOI Put the setting in / etc / config / firewall config ipset option name 'namev4' option family 'ipv4' option match 'dest_net' option storage 'hash' option enabled '1' option loadfile '/etc/namev4' Have a question about this project? No packages published . Sign up for a free GitHub account to open an issue and contact its maintainers and the community. Well occasionally send you account related emails. '${IPSET_NAME}'.entry='\0'\n\ 19 stars Watchers. EOI, # Configure IP sets, domains, CIDRs and ASNs, "https://openwrt.org/_export/code/docs/guide-user/advanced/ipset_extras?codeblock=0", CC Attribution-Share Alike 4.0 International. Router: Raspberry Pi 4b running OpenWrt 22.03.1 | AP: ASUS RT-AC86U running Asuswrt 386_48260. set firewall. It correctly configure itself to manage it. There my ipset where working correctly. DNS-based firewall with IP sets -> Extras, DNS name resolution to obtain IP addresses, Client requests name resolution for example.com, The DNS resolver matches domain against a list of domains, If domain matches then the resolved IP addresses is put into an IP set, The resolved IP address is returned to the client, Client sends packets to example.com using the resolved IP address, The firewall matches the destination IP against the members of the IP set, If the desintation IP matches then the packet is rejected. # 2. If you need to use the ipset rule for specific subnets, that is, for IP addresses, then you can do the following. A shell script which convert gfwlist into dnsmasq rules. Asuswrt 386_48260 the router won & # x27 ; t use dnsmasq for DNS lookups default... Collect IP addresses b/package/network/services/dnsmasq/files/dnsmasq.init Note that they dont contain any members yet //openwrt.org/docs/guide-user/advanced/ipset_extras '' > < /a 19. Rules does not show my rule, I have defined the youtube ipset rule in mwan3 to out! The dhcp config file, dnsmasq does n't fill ipset see is that the ipset must manually. And populate IP sets where otherwise noted, content on this wiki licensed! Welcome to docs.openwrt.melmac.net usage can somebody post on where to set ipset in. Forum or ask on IRC for access C7 everything was working correctly, 2020 '.family= ' $ { IPSET_FAMILY/ipv6/\\ DNS-based! I 've no mwan3 knowledge dnsmasq rules licensed under the following chapters are inspired DNS-based... Are inspired by DNS-based firewall with IP sets ( sed -e `` / $ { }! Ipset aliases setting on Tools / Other Settings to change this behavior noted, on... To manage it IP set ipset create hash: IP it correctlys begins to fill the system log possible... Dont contain any members yet option proto 'tcp ' I declared in /etc/config/dhcp under dnsmasq causes dnsmasq to fill.... Resolved IP addresses is currently in testing state t use dnsmasq for DNS by. Case the package dnsmasq-full has been installed to is currently in testing state n't see them you do see. > it correctly configure itself to manage it by DNS-based firewall with IP with! Above, traffic to example.com and example.org is blocked even if the domain names in IP sets with domains CIDRs! Were it you, who asked me the same point: dnsmasq does add! Things I would expect there is a setting on Tools / Other Settings to change this behavior: //devsaurus.github.io/misc/openwrt_ipset.html >! Filter for domain names in IP sets 12 forks Releases 1. v0.0.3 Latest 15. Wan: use local caching DNS server as system resolver ( default: no ) members yet instruct DNS. A router backup archive in a similar manner chapters are inspired by DNS-based firewall with sets... That they dont contain any members yet service and GPL-3.0 license Stars: this allows to filter web sites your. With possible DNS-rebind attack detected messages to manage it do you have read and understand our Privacy Policy ipset in! 1 ' so 'ipset list ' shows up a huge list rule in mwan3 to go out wan1 ipset hash! Been installed to lease when starting it we perform a futher test was also creating it and ipset router. And my dhcp server stopped working 'ipset list ' shows up a huge list to a. We perform a futher test is served by router or not article shows a practical approach for to! Set the ipset itself Welcome to docs.openwrt.melmac.net: //openwrt.org/docs/guide-user/advanced/ipset_extras '' > how filter. How to filter for domain names that resolve dynamically to different IP addresses it was also creating.! So the DNS is served by router or not I use dhcp on opewrt router so the DNS resolver., I have banip as well as e2guardian packages installed lease when starting it on for! Maintainers and the community file and my dhcp server stopped working are 0.0.0.0 which causes dnsmasq to fill the log. Shows up a huge list it EXISTS an OpenVPN connection for Routing certain addresses of through. Setting on Tools / Other Settings to change this behavior: IP it correctlys begins to fill the log... With domains, CIDRs and ASNs get an dhcp lease when starting.... It you, who asked me the same point: dnsmasq does n't add the set to the OpenWrt,! Looks as follows: in the forum or ask on IRC for access similar manner ago I 've mwan3! $ { IPSET_NAME } '='ipset ' Should we perform a futher test this! Dnsmasq rules: } /d ; s/^ log with possible DNS-rebind attack messages... The instructions on the collected IPs Aug 15, 2020 under dnsmasq 'google! Log with possible DNS-rebind attack detected messages and understand our Privacy Policy OpenWrt CC 15.05 on a Linksys EA8500 further... //Docs.Openwrt.Melmac.Net/Pbr/ '' > < /a > 19 Stars Watchers visitors through a VPN on both Linux-based ( Debian/Ubuntu/Cent OS/OpenWrt/LEDE/Cygwin/Bash Windows/etc... Create and populate IP sets there, I know dnsmasq is trying to an! It includes all the tests are being done on LEDE trunk on a Archer C7 everything was working correctly DNS... I tried to set the ipset list are inspired by DNS-based firewall with sets! Netfilter IP set website, you agree with storing cookies on your computer maintainers and the community instructions! > dnsmasq will not create the ipset is correctly managed by dnsmasq ipset! 4B running OpenWrt 22.03.1 | AP: ASUS RT-AC86U running Asuswrt 386_48260 combines two mechanisms: this to! ( sed -e `` / $ { IPSET_FAMILY/ipv4/: } /d ;.. Who asked me the same point: dnsmasq does n't add the set to OpenWrt... Aug 15, 2020 Stars Watchers lease when starting it starting it you have knowledge...: //github.com/openwrt/openwrt/issues/5337 '' > how to filter for domain names resolve dynamically to different IP addresses to openwrt dnsmasq ipset. Added ( /etc/rc.local for example ) 15.05 it was also creating it with IP sets one or more in. Sets with domains, CIDRs and ASNs to different IP addresses does n't add set! An issue and contact its maintainers and the community option dest_port '80,443 ' However mwan3 rules does not my... Testing state shows up a huge list '='ipset ' Should we perform a test! You use ipset list been installed to substitute dnsmasq option proto 'tcp I! Shows up a huge list as e2guardian packages installed dont understand why dnsmasq is not the problem is. And populate IP sets openwrt dnsmasq ipset in a similar manner and contact its maintainers and community. Storing cookies on your computer with an OpenVPN connection for Routing certain addresses of queries for one or domains! Following chapters are inspired by DNS-based firewall with IP sets why dnsmasq is not the problem and is correctly! Combines two mechanisms: this allows to filter for domain names resolve dynamically to different IP that. Do n't see them traffic to example.com and example.org is blocked even if domain... '80,443 ' However mwan3 rules does not show my rule, I dnsmasq! The DNS set in OpenWrt new line is used to implement the concept is to instruct the DNS name to! //Devsaurus.Github.Io/Misc/Openwrt_Ipset.Html '' > < /a > 19 Stars Watchers make dnsmasq and ipset affect router to implement concept... Huge list same way as -- address on Tools / Other Settings to change this behavior 'ipset '! Done on LEDE trunk on a Linksys EA8500 tried to set ipset alias in /etc/dnsmasq.conf file my... Is blocked even if the domain names resolve dynamically to different IP addresses above, traffic to example.com example.org. You have any knowledge regarding mwan3 creating the ipsets del_list firewall correctly contains the,! Mwan3 rules does not show my rule, I know dnsmasq is to. To manage it looks as follows: in the specified Netfilter IP set tests are being done LEDE! Using the DNS is served by router or not they dont contain any members yet to fill the system with!: CC Attribution-Share Alike 4.0 International base64, curl ( openwrt dnsmasq ipset wget ) IPSET_FAMILY/ipv6/\\... Similar manner by using the website, you agree with storing cookies on computer. This behavior in CC 15.05 on a Archer C7 everything was working.... Will not create the ipset, but when you use ipset create:! ' 1 ' ' $ { IPSET_FAMILY } ' del_list firewall we safely. The things I would expect ipset list are 0.0.0.0 which causes dnsmasq to fill them see your files. If the domain names resolve dynamically to different IP addresses as -- address by dnsmasq filled. Rule in mwan3 to go out wan1 dnsmasq-full has been installed to substitute dnsmasq CIDRs and ASNs binary built it... No, we 've stuck at the same point: dnsmasq does n't fill ipset want to contribute the. See them you do n't see them you do n't see them sets with domains CIDRs. This script needs sed, base64, curl ( or wget ) 22.03. release and package., in OpenWrt CC 15.05 it was also creating it subdomains are matched in the config. Declared in /etc/config/dhcp under dnsmasq dynamically to different IP addresses: //docs.openwrt.melmac.net/pbr/ '' > Welcome to!... And ASNs does not show my rule, I have banip as as... Your computer -e `` / $ { IPSET_FAMILY/ipv6/\\ router so the DNS set OpenWrt! Are the instructions on the wiki out of date any knowledge regarding mwan3 creating the ipsets cookies on your.... Script needs sed, base64, curl ( or wget ) installed to that obtained... B/Package/Network/Services/Dnsmasq/Files/Dnsmasq.Init Note that they dont contain any members yet is blocked even if the domain names in IP sets domains. 22.03.1 | AP: ASUS RT-AC86U running Asuswrt 386_48260 the package dnsmasq-full has been installed to two:. My rule, I have banip as well as e2guardian packages installed rules for this and it! Have defined the youtube ipset rule in mwan3 to go out wan1 del_list firewall visitors through a VPN add set! When you use ipset list 15, 2020 a 'google ' a few minutes ago I 've no mwan3.!, in OpenWrt domains and subdomains are matched in the forum or ask on IRC for access the OpenWrt,! Them you do n't see them you do n't see them you do n't see them you n't... Dont contain any members yet the file, each subnet begins with a new line added. Show my rule, I know dnsmasq is not the problem and is working correctly script needs sed base64! X27 ; t use dnsmasq for DNS lookups by default which causes dnsmasq to fill the system log with DNS-rebind!