0

I am trying to change the nameservers being used by my Ubuntu machine (just my laptop, not a server).

In the good old days in which I was using Slackware I just needed to edit /etc/resolv.conf and my job was done.

After figuring out that /etc/resolv.conf is actually generated by resolvconf I edited /etc/resolvconf/resolv.conf.d/head as such:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 8.8.8.8
nameserver 8.8.4.4

But my job is not done. I see that an unwanted line is still added in /etc/resolv.conf:

nameserver 127.0.1.1

I don't like this because I want the name resolution to fail just after trying Google's nameservers. This line isn't in any file in /etc/resolvconf/resolv.conf.d/ and here my confusion begins. By sudo netstat -ltnp I see that I have a name server daemon running on my laptop:

tcp        0      0 127.0.1.1:53            0.0.0.0:*               LISTEN      4889/dnsmasq

Why would I need that? I cannot remove the package containing dnsmasq (which is dnsmasq-base) because these packages depend on it:

  checkbox-gui checkbox-qt dnsmasq-base network-manager network-manager-gnome plainbox-provider-checkbox plainbox-provider-resource-generic ubuntu-desktop

Is this service running on port 53 really necessary to the well-being of my machine? How can I prevent it from running without using GUI tools and without compromising NetworkManager?

Attempt to a solution

Tried altering /etc/NetworkManager/NetworkManager.conf and restarting NetworkManager by commenting the line referring to dnsmasq

[main]
plugins=ifupdown,keyfile,ofono
#dns=dnsmasq

[ifupdown]
managed=false

The aforementioned unwanted line in resolv.conf did indeed disappear. But, unfortunately it seems to be replaced to this line: 

nameserver 192.168.0.1

Would be nice to have some elucidation on the meaning and purpose of such behavior.

A temporary fix is to remove the link /etc/resolv.conf -> ../run/resolvconf/resolv.conf and creating a new /etc/resolv.conf file from scratch. This would work.. somewhat. It would not add other useful name informations (such as the search directives) that come from the DHCP. So, a definitive solution that allows resolv.conf to be generated by resolvconf or NetworkManager still needs to be found.

fstab
  • 135

2 Answers2

1

First of all, you generally don't need to edit files in /etc/resolvconf/resolv.conf.d/ in order to obtain the desired behavior. Editing those files should be regarded as a temporary hack. Generally you want to configure your interface configurer (in your case NetworkManager) to behave the way you want.

To remove nameserver 127.0.1.1 you did the right thing, you commented out dns=dnsmasq in /etc/NetworkManager/NetworkManager.conf. That prevents NetworkManager from starting a local forwarding nameserver (a dnsmasq instance) which listens at IP address 127.0.1.1. When that address is not registered with resolvconf, resolvconf exposes other nameserver addresses in /etc/resolv.conf that have been provided to it. The address 192.168.0.1 that appears in your resolv.conf must come either from one of the files in /etc/resolvconf/resolv.conf.d/ or from an interface configurer which sends nameserver information to resolvconf. You are using NetworkManager so what you want to do is to configure NetworkManager not to use (i.e., not to forward to resolvconf) any nameserver addresses that it receives from the DHCP server. The configuration dns=none (suggested by Serg) would do this. However, the more conventional thing to do is to leave /etc/resolvconf/resolv.conf.d/head alone (i.e., with just the warning comment) and to use NetworkManager's connection editor to select Method: Automatic (DHCP) addresses only and the desired addresses (in your case, 8.8.8.8 and 8.8.4.4) in the Additional DNS servers field on the IPv4 Settings tab.

jdthood
  • 12,625
1

The rationale behind the introduction of dnsmasq as a local DNS relay is stated here in a blogpost by Stéphane Graber.

Citing the main reason:

This was done to better support split DNS for VPN users and to better handle DNS failures and fallbacks. This dnsmasq server isn’t a caching server for security reason to avoid risks related to local cache poisoning and users eavesdropping on other’s DNS queries on a multi-user system.

The big advantage is that if you connect to a VPN, instead of having all your DNS traffic be routed through the VPN like in the past, you’ll instead only send DNS queries related to the subnet and domains announced by that VPN. This is especially interesting for high latency VPN links where everything would be slowed down in the past.

You'll also find many comments following !

alci
  • 5,979