example_dnsmasq.conf

# Common options for privacy, security and performance
domain-needed
bogus-priv
dhcp-fqdn
localise-queries
no-resolv
cache-size=10000
dhcp-authoritative
dhcp-rapid-commit
bogus-nxdomain=64.94.110.11
dhcp-name-match=set:wpad-ignore,wpad
dhcp-ignore-names=tag:wpad-ignore
log-async=5

# what is my own name? set it here
# we assume our router is also calling itself 192.168.1.1 in /etc/hosts.conf
domain=myhostname.net
dhcp-option=option:domain-search,myhostname.net
local=/myhostname.net/
address=/myhostname.net/192.168.1.1

# cloudflare dns
server=1.1.1.1
server=1.0.0.1
# your own resolver on port 5053
#server=127.0.0.1#5053

# listen on all interfaces, except...
interface=*

# ... don't allow Dnsmasq on the internet facing interfaces
except-interface=ppp0
#except-interface=eth0

# The addresses you configured for your AP/LAN
dhcp-range=myhostname,192.168.1.1,192.168.1.254,12h
dhcp-range=myhostname,192.168.2.1,192.168.2.254,12h

# Put a blocklist here for ad/malware filtering
#conf-file=/etc/dnsmasq.d/badsites.txt

# static IPs
dhcp-host=pancake,192.168.1.1,infinite

# advertise ourselves as router
dhcp-option=option:router,192.168.1.1
dhcp-option=option:dns-server,192.168.1.1