DNS forwarding for guest domains on isolated network

[Jörg Kastning]

On 11.11.20 14:47, Laine Stump wrote:
> On 11/11/20 3:40 AM, Jörg Kastning wrote:
[...]
>> # My issue
>>
>> Nameresolution for *.private1 works fine on this network. But I'm not 
>> able to resolve domains from the outside world like github.com.
> 
> This behavior is intentional:
> 
>    https://gitlab.com/libvirt/libvirt/-/commit/513122ae93
> 
>>
>> I understood that libvirt is forwarding dns resolution requests to the 
>> hosts nameserver configured in /etc/resolv.conf in case the dnsmasq 
>> instance for the virtual network is not able to resolve the name.
> 
> Not for isolated networks, because a DNS request could be used to break 
> out of an isolated network (by using "IP over DNS")
> 
>>
>> My guess, in my setup this don't work, because the virtual switch is 
>> in isolated mode, right?
> 
> When DNS traffic is forwarded by a DNS server, it is at application 
> level, not IP level, so any filtering of forwarded traffic on the switch 
> is not involved.
> 
>>
>> # My questions
>>
>>   * What can I do to achieve my use case described above?
>>
>>   * Is it possible to use the isolated mode here or do I have to use a 
>> different mode?
> 
> "no-resolv" will always be in the dnsmasq config file for an isolated 
> network, and there isn't any way to remove it (other than using a 
> different kind of network). And since there is not (as far as I know) a 
> different dnsmasq option to counteract a "no-resolv" that's already 
> there, you can't eliminate the effect of no-resolv by adding something 
> to the conf file with <dnsmasq:options>. A few things to try:
> 
> 1) try adding <forwarder addr='x.x.x.x'/> in the the <dns> section of 
> the network, pointing to your normal DNS server. Possibly that directive 
> to dnsmasq will make a "side run" around the restriction on forwarding. 
> (this can also have "domain='blah'" added, in which case it only 
> forwards requests for names within the 'blah' domain ).
> 
>     https://libvirt.org/formatnetwork.html#elementsAddress
> 
> 2) use a <forward mode='route'> network, but also add in nwfilter rules 
> that only allow traffic on the local network.
> 
>     https://libvirt.org/formatnwfilter.html
> 
> 3) again, use <forward mode='route'>, but also manually add a rule to 
> the host iptables that rejects all traffic from the guest network 
> outbound on the host's egress interface.
> 
>> It's important that the guest domains could only connect to the 
>> internet by using the proxy.
> 
> 
> Have you tried putting the guests
> 

Hi,
Thanks for your reply Laine.

I solved this by finding a way where I don't need the DNS resolution at all.

To be able to reach internet domains through a proxy I configured the 
proxy via the enironment variables http_proxy and https_proxy. This way 
tools like `curl` or `git` hand over the request to the proxy and the 
proxy resolves the domain.

Didn't think about this option earlier.

Thanks again for your good explanation.

Regards,
Joerg