I have recently added several VLANs to my lab's network. While some of them have been put in place for purely administrative purposes, there is also a guest VLAN which I would like to keep completely separate from the rest of the network. I use dnsmasq for both DNS and DHCP, and the configuration with multiple VLANs works flawlessly. Also iptables does its assigned task of preventing communication between the guest VLAN and all the others, but there is a problem with dnsmasq: DNS queries (both direct and inverse) about machines not belonging to the guest VLAN are correctly answered by dnsmasq to users of the guest VLAN. Surely, in order for the queries to work one needs to know either the subnet of the other VLANs, or the machine names, and also iptables keeps  the various VLANs isolated from each other. But I still feel that a determined attacker might easily find that there are other subnets, what their IP ranges are, and could guess at some of the machine names, which I am afraid may weaken my configuration.Is there any option in dnsmasq to configure it to reply only to queries about the private network from which the query is coming (plus of course queries about public addresses)? Or in other words: can dnsmasq be configured in such a way as to drop queries about different private subnets? 
Cross-queries from VLANs in dnsmasq
dns;dnsmasq;vlan