dnsmasq on Ubuntu 24.04 LTS

dnsmasq is a small, widely deployed network infrastructure daemon that combines a caching DNS forwarder, a DHCP server and a TFTP boot server in a single lightweight package. This cloudimg image runs dnsmasq 2.90 on Ubuntu 24.04 LTS, configured as a responsible, secure by default caching DNS forwarder for local networks, edge sites, labs and container hosts.

Security is built in as a non open resolver. An open forwarding resolver is a well known DNS amplification and reflection DDoS vector, so this image ships with dnsmasq local-service mode: the server answers DNS only for hosts whose source address is on a local subnet of the VM. A query arriving from the public internet is silently dropped, never answered and never reflected, so the server cannot be abused as an amplifier. Non qualified names and private reverse lookups are never sent upstream, and forwarding uses an explicit upstream list.

DHCP and TFTP are present in the daemon but disabled by default: running a DHCP server on a network you do not own is a rogue DHCP hazard, and an open TFTP root is a data exfiltration vector, so you enable each one deliberately for your own network. A shipped local example record lets a dig query resolve out of the box, and the systemd-resolved stub listener is disabled so dnsmasq owns port 53. dnsmasq has no login or admin password, so no shared secret ships in the image.

dnsmasq is distributed under the GNU General Public License version 2, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the dnsmasq project or Simon Kelley. cloudimg provides packaging, secure by default hardening, security patching, and 24/7 support with a guaranteed 24 hour response SLA.