Hello *,
I've just finished hacking dnsmasq into a useable state to replace my ISC DHCP instance. I came across 2 issues that I don't quite know how to handle best and would like to tap the forum for this. I have bolted dnsmasq into unbound via query forwarding.
I can't find a way to restrict dnsmasq to listen for DNS queries on 127.0.0.1 only. I don't want dnsmasq to be available as DNS server everywhere it is used as a DHCP server. It should only be visible to unbound as a forwarding destination.
To enable DNS reverse lookups, I have configured unbound to also forward "168.192.in-addr.arpa" to dnsmasq. It works well, reverse lookups for non-local IP addresses work, too, but I'm wondering if this solution is a bit too clever.
Version 26.7
If you used these instructions to setup dnsmasq, then dnsmasq would be configured with a different port (53035) than unbound (53). This way, only unbound is used for normal dns and other clients cannot access dnsmasq via 53053 unless you create a rule for it. The instructions also discuss reverse lookups which is basically done the way you have already configured.
Edit: link to instructions: https://docs.opnsense.org/manual/dnsmasq.html