Is mandatory to use dnsmasq?

[HulaHoop]

According got another user, yes it is mandatory with the way NAT networking is implemented by libvirt to have this package installed and running. He was going to create a dummy stub and change the Whonix networking files to attempt to trick it into running with dnsmasq not being active , but never reported back. Either way it’s too much hassle and not a big deal see why below:

Whonix KVM dnsmasq - listen port on host operating system - attack surface reduction

I tested setting up a brand new KVM host without dnsmasq installed and with the default KVM network deleted. I was able to import the Whonix-External network but could not start it due to an error about dnsmasq command being missing. So it appears this is required for NAT networks in particular and not purely the default network. I will test two things: Creating a stub dnsmasq executable that will simply exit 0 or halts execution so that it appears to be running in the background; and Modif…

There’s no risk of dnsmasq as installed by libvirt in being exploited because it doesn’t listen on any external interfaces and only responds to guest requests using a limited subset of its functionality. If you are running an untrusted guest, you probably don’t want it on the virbr0 interface that interacts with the clearnet anyway.