dnsmasq DNS network separation?

[sbellon]

Hi all,

I successfully upgraded from OPNsense 26.1 to 26.7 and also got rid of all legacy components. I replaced Track Interface with Identity Association, migrated from the old NAT and Firewall rules to the new ones, and replaced my usage of ISC DHCP (v4 and v6) as well as radvd by using only dnsmasq for everything DNS and DHCP with the idea of having fewer software components running and to maintain (also no Unbound DNS, also didn't use it before).

One surprise during that migration was, that I had to configure an RA MTU of 1492 in the dnsmasq's DHCPv6 ranges, as otherwise I was not able to reach some IPv6 sites (notably Microsoft ones) from GNU/Linux and Android devices.

But apart from that and in general, everything is up and running as before.

One thing however is puzzling me and I am not sure whether it is a misconfiguration or expected if dnsmasq is doing everything DNS and DHCP:

I have a separation of networks (e.g. LAN, IoT, Guests), all with their respective configurations for IPv4, IPv6, DNS, DHCP etc.

Now, I can do e.g. `host some-iot-device` on a LAN device and get the IP address of the IoT device within the IoT network resolved. I would have expected name resolution to be restricted to the same network the querying device is in?

Is this a misconfiguration? Can I configure name resolution to be bound to the network? Or is this just the "price" I have to pay when using dnsmasq for DNS and DHCP?

TIA.