# DO NOT EDIT THIS FILE -- OPNsense auto-generated file
#

{% if helpers.exists('system.webgui.nodnsrebindcheck') %}
rebind-localhost-ok
stop-dns-rebind
{% endif %}

{% if dnsmasq.port %}
port={{ dnsmasq.port }}
{% endif %}

{% if dnsmasq.interface %}
# If you want dnsmasq to listen for DHCP and DNS requests only on
# specified interfaces (and the loopback) give the name of the
# interface (eg eth0) here.
# Repeat the line for more than one interface.
interface={{helpers.physical_interfaces(dnsmasq.interface.split(','))|join(',')}}
{% endif %}

{% if dnsmasq.dhcp.no_interface %}
# If you want dnsmasq to provide only DNS service on an interface,
# configure it as shown above, and then use the following line to
# disable DHCP and TFTP on it.
no-dhcp-interface={{helpers.physical_interfaces(dnsmasq.dhcp.no_interface.split(','))|join(',')}}
{% endif %}

{% if dnsmasq.dhcp.lease_max %}
dhcp-lease-max={{dnsmasq.dhcp.lease_max}}
{% endif %}

{% if dnsmasq.dhcp.fqdn == '1' %}
dhcp-fqdn
domain={{dnsmasq.dhcp.domain|default(system.domain)}}
{% endif %}

{% if dnsmasq.dhcp.authoritative == '1' %}
dhcp-authoritative
{% endif %}

{% if dnsmasq.dhcp.reply_delay %}
dhcp-reply-delay={{dnsmasq.dhcp.reply_delay}}
{% endif %}

{# Globally enable RA #}
{% if dnsmasq.dhcp.enable_ra|default('0') == '1' %}
enable-ra
{% endif %}

{% if dnsmasq.strictbind == '1' %}
# On systems which support it, dnsmasq binds the wildcard address,
# even when it is listening on only some interfaces. It then discards
# requests that it shouldn't reply to. This has the advantage of
# working even when interfaces come and go and change address. If you
# want dnsmasq to really bind only the interfaces it is listening on,
# uncomment this option. About the only time you may need this is when
# running another nameserver on the same machine.
bind-interfaces
{% endif %}

{% if dnsmasq.add_mac %}
add-mac{% if dnsmasq.add_mac != 'standard' %}={{dnsmasq.add_mac}}{% endif %}
{% endif %}

{% if dnsmasq.add_subnet %}
add-subnet=32,128
{% endif %}

{% if dnsmasq.strip_subnet %}
strip-subnet
{% endif %}

{% if dnsmasq.no_private_reverse == '1' %}
# Never forward addresses in the non-routed address spaces.
bogus-priv
{% endif %}

{# Domain Overrides can be sorted by sequence to support strict order #}
{% for override in helpers.toList('dnsmasq.domainoverrides', sortBy='sequence', sortAs='int') %}
server=/{{override.domain}}/{{override.ip}}{%if override.port %}#{{override.port}}{% endif %}{%if override.srcip %}@{{override.srcip}}{% endif +%}
{%    if helpers.exists('system.webgui.nodnsrebindcheck') %}
rebind-domain-ok=/{{override.domain}}/
{%    endif %}
{% endfor %}

{% if dnsmasq.strict_order == '1' %}
# By  default,  dnsmasq  will  send queries to any of the upstream
# servers it knows about and tries to favour servers to are  known
# to  be  up.  Uncommenting this forces dnsmasq to try each query
# with  each  server  strictly  in  the  order  they   appear   in
# /etc/resolv.conf
strict-order
{% endif %}

{% if dnsmasq.domain_needed  == '1' %}
# Never forward plain names (without a dot or domain part)
domain-needed
{% endif %}


{% if dnsmasq.dnssec  == '1' %}
# Uncomment these to enable DNSSEC validation and caching:
# (Requires dnsmasq to be built with DNSSEC option.)
conf-file=/usr/local/share/dnsmasq/trust-anchors.conf
dnssec
{% endif %}

{% if dnsmasq.log_queries  == '1' %}
# For debugging purposes, log each DNS query as it passes through
# dnsmasq.
log-queries=extra
{% endif %}

{% if dnsmasq.no_hosts  == '1' %}
# If you don't want dnsmasq to read /etc/hosts, uncomment the
# following line.
no-hosts
{% endif %}

# host entries flushed via dnsmasq_watcher.py [isc] and a dump of the static reservations
addn-hosts=/var/etc/dnsmasq-hosts
addn-hosts=/var/etc/dnsmasq-leases

dns-forward-max={{dnsmasq.dns_forward_max|default('5000')}}
cache-size={{dnsmasq.cache_size|default('10000')}}
local-ttl={{dnsmasq.local_ttl|default('1')}}

conf-dir=/usr/local/etc/dnsmasq.conf.d,\*.conf

{% for dhcp_range in helpers.toList('dnsmasq.dhcp_ranges') %}
{% if dhcp_range.start_addr and ':' not in dhcp_range.start_addr %}
{# IPv4 range #}
dhcp-range={%if dhcp_range.interface -%}
tag:{{helpers.physical_interface(dhcp_range.interface)}},
{%- endif -%}
{%- if dhcp_range.set_tag -%}
set:{{dhcp_range.set_tag|replace('-','')}},
{%- endif -%}
{{dhcp_range.start_addr}},
{%- if dhcp_range.end_addr -%}
{{ dhcp_range.end_addr }},
{%- endif -%}
{%- if dhcp_range.mode -%}
{{dhcp_range.mode}},
{%- endif -%}
{{dhcp_range.lease_time|default('86400')}}
{% else %}
{# IPv6 range and RA #}
dhcp-range={%if dhcp_range.interface -%}
tag:{{helpers.physical_interface(dhcp_range.interface)}},
{%- endif -%}
{%- if dhcp_range.set_tag -%}
set:{{dhcp_range.set_tag|replace('-','')}},
{%- endif -%}
{{dhcp_range.start_addr}},
{%- if dhcp_range.end_addr -%}
{{ dhcp_range.end_addr }},
{%- endif -%}
{%- if dhcp_range.constructor -%}
constructor:{{helpers.physical_interface(dhcp_range.constructor)}},
{%- endif -%}
{%- if dhcp_range.mode -%}
{{dhcp_range.mode}},
{%- endif -%}
{#- Using a prefix other than 64 is illegal when slaac is used. -#}
{%- if not dhcp_range.ra_mode and dnsmasq.dhcp.enable_ra|default('0') == '0' -%}
{{ dhcp_range.prefix_len|default('64') }},
{%- endif %}
{%- if dhcp_range.ra_mode %}{{ dhcp_range.ra_mode }},{% endif %}
{{ dhcp_range.lease_time|default('86400') }}
{% endif %}

{% if dhcp_range.domain %}
domain={{ dhcp_range.domain }},{{dhcp_range.start_addr}},{{dhcp_range.end_addr}}
{% endif %}

{#- Only gets added if a custom ra_mode is chosen, otherwise the global defaults of enable-ra are used. -#}
{% if dhcp_range.ra_mode and dhcp_range.interface %}
ra-param={{ helpers.physical_interface(dhcp_range.interface) }}
{%- if dhcp_range.ra_mtu %},mtu:{{ dhcp_range.ra_mtu }}{% endif -%}
{%- if dhcp_range.ra_priority %},{{ dhcp_range.ra_priority }}{% endif -%},
{%- if dhcp_range.ra_interval %}{{ dhcp_range.ra_interval }}{% else %}60{% endif -%},
{%- if dhcp_range.ra_router_lifetime %}{{ dhcp_range.ra_router_lifetime }}{% else %}1200{% endif +%}

{% endif %}
{% endfor %}

{% for host in helpers.toList('dnsmasq.hosts') %}
{#     Skip if MAC is missing or invalid (no colon), unless client_id is present #}
{%     if not host.client_id and (not host.hwaddr or host.hwaddr.find(':') == -1) %}
{%         continue %}
{%     endif %}
dhcp-host=
{%-     if host.client_id -%}
id:{{ host.client_id }},
{%-     endif -%}
{%-     if host.hwaddr -%}
{{ host.hwaddr }},
{%-     endif -%}
{%-     if host.set_tag -%}
set:{{ host.set_tag|replace('-', '') }},
{%-     endif -%}
{%-     for ip in host.ip.split(',')|map('trim')  if host.ip -%}
{{ '[' ~ ip ~ ']' if ':' in ip else ip  }}{%- if not loop.last %},{% endif %}
{%-     endfor -%}
{%-     if host.host -%}
,{{ host.host }}
{%-     endif -%}
{%-     if host.lease_time -%}
,{{ host.lease_time }}{% else %},86400
{%-     endif -%}
{%-     if host.ignore|default('0') == '1' -%}
,ignore
{%-     endif +%}
{% endfor %}

{% set has_default=[] %}
{% for option in helpers.toList('dnsmasq.dhcp_options') %}
{%     if option.type == "set" %}
{%     set all_tags = [] %}
{%     if option.tag %}
{%         for tag in option.tag.replace('-','').split(',') %}
{%             do all_tags.append('tag:' + tag) %}
{%         endfor %}
{%     endif %}
{%     if option.interface %}
{%         do all_tags.append('tag:' + helpers.physical_interface(option.interface)) %}
{%     endif %}
dhcp-option{% if option.force == '1' %}-force{% endif -%}=
{%- if all_tags %}{{ all_tags|join(',') }},{% endif -%}
{%- if option.option6 -%}
option6:{{ option.option6 }},{{ option.value }}
{%- else -%}
{{ option.option }},{{ option.value }}
{%- endif +%}
{%     if not option.tag and not option.interface and option.option == '6' %}
{%         do has_default.append(1) %}
{%     endif %}
{%     elif option.type == "match" %}
dhcp-match=set:{{ option.set_tag.replace('-','') }},
{%-        if option.option6 -%}
option6:{{ option.option6 }}{% if option.value %},{{ option.value }}{% endif %}
{%-        else -%}
{{ option.option }}{% if option.value %},{{ option.value }}{% endif %}
{%-        endif +%}
{%     endif %}
{% endfor %}

{% if not has_default %}
# default dns mapped to this server (0.0.0.0)
dhcp-option=6,0.0.0.0
{% endif %}

{% if dnsmasq.no_ident  == '1' %}
no-ident
{% endif %}
