Correct Way to Run Additional DNS Server On Second IP on Port 53?

[HarryMuscle]

I'm trying to run an additional custom DNS server on a second IP address on port 53. However, it turns out that DNSMasq is configured with bind-dynamic which means it automatically binds to any new IP addresses added to the br0 (and other) interface. That means I can't start a second DNS server on a second IP address cause DNSMasq is already using port 53 on it. The opposite of bind-dynamic would be to configure DNSMasq with bind-interfaces so that it only binds to addresses existing on the interfaces when it starts up. However, I'm not sure if this is a safe thing to change or if DNSMasq is configured with bind-dynamic on purpose so that it continues to function under certain circumstances were IP addresses change. What would be the best approach to run a second DNS server on a second IP address on port 53 on the router?

Thanks,
Harry

 

[drinkingbird]

With all the stuff you're trying to do I think a raspberry pi or pfsense might be a better fit for you honestly.

Maybe someone has done it and will reply but you probably will just have to try changing it and seeing what happens.

 

[HarryMuscle]

With all the stuff you're trying to do I think a raspberry pi or pfsense might be a better fit for you honestly.

Maybe someone has done it and will reply but you probably will just have to try changing it and seeing what happens.

Maybe, but I'm determined to figure out how to do it on the router even if I don't end up keeping it that way

 

[tgl]

I'm trying to run an additional custom DNS server on a second IP address on port 53.

FWIW, it's fairly easy to achieve this sort of effect with old-school ISC BIND. You don't actually run more than one bind daemon, you just configure it to serve multiple "views" of what it knows, thus avoiding the overhead of redundant servers. Perhaps DNSMasq can be set up in a similar fashion, but I've never used that in anger so I'm not sure.

However, I'm not sure if this is a safe thing to change

You are right to be worried if this is your only DNS server, because if you mess it up badly enough then you will find all of your internet access to be dead-in-the-water, and recovering from that will be a bit painful. Can you do your experimentation on a spare router? This isn't really rocket science, but it's still best to lower the stakes for mistakes.