How to Configure Dnsmasq for DHCP and Port Forwarding

When configuring localized subnet environments, PXE boot networks, or isolated testbeds, deploying a heavy enterprise DHCP daemon is often unnecessary. Dnsmasq provides an incredibly lightweight, easy-to-configure solution that combines DNS caching, TFTP, and DHCP server capabilities into a single daemon.

In this guide, I will walk you through assigning static IP addresses to network interfaces using nmcli, enabling DHCP services, configuring Dnsmasq DHCP allocation ranges, and establishing strict port forwarding rules using firewalld.

Prerequisites

You will need a Linux server (CentOS/RHEL) with root privileges, configured with NetworkManager and firewalld.

---

Step 1: Configuring Network Interface via nmcli

Before starting Dnsmasq, ensure the interface on which it will serve DHCP requests (enp0s20f0u4) is assigned a permanent static IP address.

# Check active connections
nmcli connection

# Assign static IP address and subnet mask
nmcli con mod enp0s20f0u4 ipv4.addresses 172.16.253.1/24
nmcli con mod enp0s20f0u4 ipv4.method manual
nmcli con mod enp0s20f0u4 connection.autoconnect yes

# Bring up interface and verify configuration
nmcli con up enp0s20f0u4
cat /etc/sysconfig/network-scripts/ifcfg-enp0s20f0u4

---

Step 2: Firewall and Port Forwarding Configuration

Dnsmasq requires open firewall access to broadcast DHCP allocations. We also configure IP masquerading and rich port forwarding rules to route incoming web traffic to internal backend nodes.

# Enable DHCP service and Masquerading
firewall-cmd --add-service=dhcp --permanent
firewall-cmd --zone=public --add-masquerade --permanent
firewall-cmd --reload

Configuring Port Forwarding

To route incoming HTTP traffic on port 80 to an internal backend node (172.16.253.2), apply the following forwarding rule:

# Add port forwarding rule
firewall-cmd --zone="public" --add-forward-port=port=80:proto=tcp:toport=80:toaddr=172.16.253.2 --permanent

# Reload and verify
firewall-cmd --reload && firewall-cmd --list-all

---

Step 3: Dnsmasq Configuration

Update the primary configuration file /etc/dnsmasq.conf to enable DHCP leasing while disabling unnecessary DNS caching functionality.

# /etc/dnsmasq.conf
listen-address=172.16.253.1

# Disable Dnsmasq DNS server functionality
port=0

# Enable Dnsmasq DHCP server functionality with 12-hour leasing
dhcp-range=172.16.253.10,172.16.253.20,255.255.255.0,12h

# Set default gateway router option
dhcp-option=option:router,172.16.253.1

# Enable asynchronous logging
log-facility=/var/log/messages
log-async
log-queries
log-dhcp

Enable and start the Dnsmasq service:

systemctl enable dnsmasq
systemctl start dnsmasq
systemctl status dnsmasq

References

• Dnsmasq Official Documentation