bsdperimeter/pfsense — pull request #447 by phil-davis (2013-03-05 09:34:53+00:00)
Title: DNS Forwarder allow blank forwarding IP address

dnsmasq allows a blank forwarding IP address to be specified in --server parameters. In that case, dnsmasq will attempt a local lookup of names in the domain (e.g. in hosts file), but will not forward the request on to the standard name servers.
This is a useful way to prevent internal name requests from being sent out to the real internet name servers. For example, if use an internal domain mycompany.local with 2 sites:
dev.mycompany.local (pfSense box 192.168.1.1/24)
office.mycompany.local (pfsense box 192.168.2.1/24)
and a VPN site-to-site link.
On 192.168.1.1 I add domain overrides:
dev.mycompany.local to the local server IP that does full DNS for the site (if needed)
1.168.192.in-addr.arpa to the local server IP that can do reverse PTR lookups for the site (if needed)
office.mycompany.local to 192.168.2.1
2.168.192.in-addr.arpa to 192.168.2.1

then I want to stop other attempted lookups of erroneous names from being referred anywhere at all, entries are needed for:
mycompany.local to null
168.192.in-addr.arpa to null

The benefits are:
a) Lookups containing internal names do not go out on the public internet (a good thing if you are sensitive about internal company domain names)
b) Silly private IP reverse DNS PTR lookups do not go out on the public internet
c) Clients get an immediate NXDOMAIN response, rather than being delayed by a usually round trip to the public internet for a name not known response.

This change allows that to be done by specifying "!" (not) in the IP address field. IMHO this is better than allowing the field to be empty - it would be too easy for new users to leave the field empty unintentionally.