Setting up DNSMasq on Ubuntu for local network caching

Every visit to a website often begins with a DNS lookup, although most people never notice it. A home router normally forwards those requests and caches some replies. Running DNSMasq on Ubuntu gives an entire trusted network one resolver, speeds up repeated lookups and provides memorable names for a NAS, printer or virtual machine. It is particularly useful when several computers, phones, televisions and other devices share the same connection.

This guide uses a small Ubuntu server connected by Ethernet, with DNSMasq at 192.168.1.50 and the router at 192.168.1.1. Those are examples, not universal settings. The initial configuration leaves DHCP on the router, avoiding an abrupt network change, and uses home.arpa for private hostnames. DNSMasq needs only LAN access, so it works on Australian broadband connections with dynamic addresses or carrier-grade NAT just as well as on a public IPv4 service.

Choose a simple network layout

DNSMasq can run on a router, server or desktop, but an always-on Ubuntu machine is usually the least disruptive place to add it. Wired Ethernet is preferable for the resolver because Wi-Fi may sleep, disconnect or change address. Other household devices can continue using Wi-Fi. If the existing router already provides a reliable caching resolver, the speed improvement may be modest; local names, consistent configuration and easier troubleshooting often provide greater value.

Australian homes commonly connect through NBN fixed-line services such as FTTP, HFC or FTTN, as well as fixed wireless. Equipment supplied with NBN Co services may come from Netgear, TP-Link or ASUS. Many routers use 192.168.1.1, while others use 10.0.0.1, so check the actual gateway rather than assuming an address. In crowded flats in Sydney, Melbourne or Brisbane, placing the resolver on a wired Ubuntu machine also avoids relying on busy apartment Wi-Fi for every lookup.

Keep the service inside the home network. Do not bind it to a WAN interface, expose port 53 to the internet or operate it as a public DNS service. Choose an address outside the router’s DHCP pool, such as 192.168.1.50, or reserve that address through the router. If the network uses 10.0.0.0/24, change the examples to 10.0.0.50, gateway 10.0.0.1 and the corresponding firewall rule. DNSMasq does not need IP forwarding or NAT changes when it is only providing DNS.

Install and configure DNSMasq

Ubuntu packages DNSMasq from its standard repositories. Update the package information, install the daemon and stop it while replacing the default configuration:

sudo apt update
sudo apt install dnsmasq
sudo systemctl stop dnsmasq

Prepare the private host file and open the main configuration:

sudo install -d -o root -g root -m 0755 /etc/dnsmasq.d
sudo touch /etc/dnsmasq.d/local-hosts
sudo chown root:root /etc/dnsmasq.d/local-hosts
sudo chmod 0644 /etc/dnsmasq.d/local-hosts
sudoedit /etc/dnsmasq.conf

Replace the file’s contents with this example:

listen-address=127.0.0.1
listen-address=192.168.1.50
bind-interfaces
port=53

no-resolv
server=1.1.1.1
server=9.9.9.9
cache-size=1000

domain-needed
bogus-priv
domain=home.arpa
local=/home.arpa/
expand-hosts
addn-hosts=/etc/dnsmasq.d/local-hosts

The two listen-address lines restrict responses to the Ubuntu server itself and its private LAN address. The no-resolv directive prevents a feedback loop through Ubuntu’s resolver configuration, while the server lines select upstream DNS providers. Cloudflare and Quad9 are examples rather than mandatory choices; replace them with another trusted resolver if required by household policy. Test the syntax, but wait until 192.168.1.50 belongs to Ubuntu before starting the service:

sudo dnsmasq --test

Give Ubuntu a stable LAN address

The easiest method is a DHCP reservation in the router. Find the Ubuntu Ethernet interface and copy its hardware address, then reserve 192.168.1.50 for that device. This lets Ubuntu continue using DHCP while guaranteeing that the address in /etc/dnsmasq.conf remains correct. Some NBN plans use bridge mode and a separate router, so the reservation may need to be made in the device that actually runs DHCP.

A static Netplan address is the alternative. Replace enp3s0 with the interface reported by ip -br link, and replace the example addresses if your network differs:

network:
  version: 2
  ethernets:
    enp3s0:
      dhcp4: no
      addresses:
        - 192.168.1.50/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses:
          - 127.0.0.1
          - 1.1.1.1

Save the file, generate the configuration and use the trial command before applying it permanently:

sudo netplan generate
sudo netplan try
sudo systemctl enable --now dnsmasq

netplan try automatically reverts an unsuccessful change when run from an SSH session. With a DHCP reservation, reconnect the Ethernet interface or reboot Ubuntu first, then start DNSMasq. Confirm that the expected address is present with ip -br address and that the service reports active.

Advertise DNS and add local names

The router’s DHCP server must tell clients to use 192.168.1.50 as their DNS server. Look for a setting labelled DHCP DNS, DNS server or LAN DNS, rather than the Internet or WAN DNS setting. The router should continue advertising itself as the default gateway. Existing leases may need to be renewed or the client rebooted. If the router offers no custom DNS option, configure DNS manually on each device.

On Android, set DNS through the Wi-Fi network’s advanced IP settings; Android Private DNS expects a DNS-over-TLS hostname and is not the place for a private IP address. iOS permits manual DNS for an individual Wi-Fi network. Browser-level secure DNS and encrypted DNS applications may bypass the local resolver entirely, so those features need to be disabled if every lookup should pass through DNSMasq.

Add local devices to the prepared host file:

sudoedit /etc/dnsmasq.d/local-hosts

For example:

192.168.1.20 nas
192.168.1.21 office-printer
192.168.1.30 test-vm

After saving, restart DNSMasq. The devices will then answer as nas.home.arpa, office-printer.home.arpa and test-vm.home.arpa. The home.arpa namespace is intended for private networks and avoids the multicast name collisions that can occur with .local.

DNSMasq can also provide DHCP, although that is not required for caching. If the router cannot advertise a custom DNS server, add settings such as these:

dhcp-range=192.168.1.100,192.168.1.199,255.255.255.0,12h
dhcp-option=option:router,192.168.1.1
dhcp-option=option:dns-server,192.168.1.50

Disable the router’s DHCP server before enabling these lines, because two active DHCP servers can assign conflicting addresses. Keep access to the router from a wired device while making the change, and ensure the DNSMasq address remains outside the new lease range.

Secure and verify the setup

If UFW is active, permit DNS traffic only from the trusted LAN. Change the subnet if the home network uses 10.0.0.0/24:

sudo ufw allow from 192.168.1.0/24 to any port 53 proto udp
sudo ufw allow from 192.168.1.0/24 to any port 53 proto tcp

DNS normally uses UDP, while TCP is needed for large responses and certain specialised queries. Enabling UFW on a remote server also requires an existing SSH rule using the correct port. The listening addresses should remain limited to loopback and the private LAN interface.

Install dig if necessary and query the resolver directly:

sudo apt install dnsutils
dig @127.0.0.1 example.com
dig @127.0.0.1 nas.home.arpa

Run the first query twice and observe the decreasing TTL in the answer section. Check that port 53 is bound only to 127.0.0.1 and 192.168.1.50:

sudo ss -lntup | grep ':53'
sudo systemctl status dnsmasq

If a client still uses the router as DNS, renew its network lease and check the router’s DHCP settings. Service errors appear in journalctl -u dnsmasq; common causes include an incorrect LAN address, restrictive file permissions or another process already listening on the same address and port. Restarting DNSMasq clears its cache, which is harmless because the upstream records will be fetched again.

Once clients use the Ubuntu resolver, DNSMasq quietly handles repeated lookups and local names while leaving the router responsible for internet access and DHCP. The essential arrangement is a stable private address, trusted upstream servers, LAN-only listening and client settings that actually point to 192.168.1.50.