From c5015faafedf8999d4838886d5fe2a043cfa83bc Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Mon, 15 Apr 2024 08:07:41 +0200 Subject: [PATCH] dnsmasq: only listen on loopback :53, as local resolver Even though dnsmasq only listened to requests from 127.0.0.1, port 53 was visible using nmap. We only use dnsmasq as a local resolver, so we can safely change the config to bind to loopback instead, and at the same time get less noise from nmap scans. Signed-off-by: Joachim Wiberg --- board/common/rootfs/etc/dnsmasq.conf | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/board/common/rootfs/etc/dnsmasq.conf b/board/common/rootfs/etc/dnsmasq.conf index f093056b..15b085a6 100644 --- a/board/common/rootfs/etc/dnsmasq.conf +++ b/board/common/rootfs/etc/dnsmasq.conf @@ -2,8 +2,12 @@ # managed by openresolv. DHCP lease, VPN tunnel establishment, # and similar events feed servers and configuration to dnsmasq. domain-needed -#interface=lo -listen-address=127.0.0.1 + +# Only listen to loopback (local system) +interface=lo +bind-dynamic +#listen-address=127.0.0.1,::1 + enable-dbus # Generated by openresolv