Comment 2 for bug 1414887

Ah, thanks Thomas. You lead me to the right direction.

As Simon Kelley, the author of dnsmasq said in the new dnsmasq manpag, `local-service` is intended to be set as a default on installation, to allow unconfigured installations to be useful... it will have no effect, but for otherwise-unconfigured installations, it stops dnsmasq from being vulnerable to DNS-reflection attacks, I'm changing this bug report to bear the purpose to have dnsmasq better configured out of box for Ubuntu (14.10+).

- First, as suggested by the author of dnsmasq, the `local-service` should be in the default configuration. However, Ubuntu 14.10 doesn't have that:

% cat /etc/dnsmasq.conf /etc/dnsmasq.d/network-manager | sed '/^$/d; /^#/d'
bind-interfaces

- Second, unlike its previous version, Ubuntu 14.10 now starts dnsmasq in a very restricted way. Here is what I found out how dnsmasq is started in Ubuntu 14.10:

 /usr/sbin/dnsmasq --no-resolv --keep-in-foreground --no-hosts --bind-interfaces --pid-file=/run/sendsigs.omit.d/network-manager.dnsmasq.pid --listen-address=127.0.1.1 --conf-file=/var/run/NetworkManager/dnsmasq.conf --cache-size=0 --proxy-dnssec --enable-dbus=org.freedesktop.NetworkManager.dnsmasq --conf-dir=/etc/NetworkManager/dnsmasq.d

I.e., that ` --listen-address=127.0.1.1` will willfully ignore any dns queries from localnetwork. This is the exact reason causing the symptom that I reported.

I believe this setting should not be there, because

1. for people that need the setting, it is very easy to put it into a conf file under /etc/dnsmasq.d/;
2. however, it will make it very very difficult for people who don't need it to get rid of it unless altering the package installation.
3. Ubuntu should really ship the default setting of `local-service` instead of `listen-address`, because it is a safer default and not invasive in the meantime. it will "have no effect" but for an otherwise-unconfigured installation.

Please consider.

Meanwhile, is there any better way to get rid of that ` --listen-address=127.0.1.1`? The least that I want is to altering the package installation.

Thanks