Home firewall/router no internet access using firewalld networkmanager

I agree with @FrankCox a tiny bit.


Preface:
When we use a name, our machine has to resolve it into address, because it needs address of destination to send (almost) anything. DNS is the normal method to resolve addresses. In it our machine sends a query to DNS server. The DNS server is a service that runs on some computer and handles DNS queries. A query like: “What is address of name?”. Our machine naturally needs the address of DNS server in order to send the query.


To me that did initially read:
Why isn’t 192.168.99.1 replying to DNS queries?

If so, then that is not about how the LAN machine is configured to send DNS queries to 192.168.99.1,
but a question:
Why does 192.168.99.1 not have DNS service running?

For that we do have an answer:

That is, no DNS service has been installed nor configured in the router.


Looking at what I wrote above, I see an another interpretation for the:

Maybe that really asks:
Why does the DHCP in the router not provide any/correct DNS server address for the clients?

Like @FrankCox wrote, the DHCP service has to be configured to send an appropriate DNS server address along the other configuration data.


As I wrote earlier, I do use ‘dnsmasq’ for DHCP and DNS.
However, I keep the dnsmasq.service disabled. I let NetworkManager do the work.

I have in /etc/NetworkManager/conf.d/00-dns.conf:

[main]
dns=dnsmasq

When the NetworkManager starts, it starts also a dnsmasq process to background, configured as caching relay, and configures the machine to send DNS queries to the dnsmasq. The dnsmasq does then forward the queries to the DNS servers that ISP told us.

The default name resolution routine is in glibc library. The dnsmasq is a bit smarter than the default, but naturally has the cost of an additional process.

The above is DNS just for this machine. We can give it additional config to enable the DHCP.
Something like:
In file /etc/NetworkManager/dnsmasq.d/dnsmasq-dlrapp.conf:

domain-needed
bogus-priv
expand-hosts
domain=dlrapp,192.168.99.0/24,local
interface=enp2s0
listen-address=192.168.99.1

# DHCP pool setup
dhcp-range=192.168.99.100,192.168.99.240,24h
dhcp-option=option:router,192.168.99.1

# Static mappings
dhcp-host=52:54:00:01:02:03,192.168.99.2

The dnsmasq will automatically include dhcp-option=option:dns-server,192.168.99.1

In the above config

  • if a machine has MAC address 52:54:00:01:02:03, then it will always get IP address 192.168.99.2
  • If MAC of machine is not in any ‘dhcp-host’, then it will get next unused address from range 192.168.99.100--192.168.99.240

The firewall has to allow LAN machines to talk with the dnsmasq in the router:

firewall-cmd --zone=internal --permanent --add-service=dns
firewall-cmd --reload

but that you do already have.


Note:

The sources: 192.168.99.0/24 is redundant.

The above config says that when a packet comes in:

  • IF it has source address in 192.168.99.0/24 (regardless of interface) THEN it is in zone internal
  • IF it came via interface enp2s0 THEN it is in zone internal

That means that if there were someone on the enp1s0 side with a address 192.168.99.x, then that too would be allowed what zone internal allows.