diff --git a/modules/dnsmasq/manifests/init.pp b/modules/dnsmasq/manifests/init.pp
new file mode 100644
index 0000000..1fcfdd5
--- /dev/null
+++ b/modules/dnsmasq/manifests/init.pp
@@ -0,0 +1,51 @@
+# manage dnsmasq as a dns forwarder and dhcp relay
+class dnsmasq (
+  Boolean $manage_package                    = true,
+  Boolean $manage_service                    = true,
+  String  $package_name                      = 'dnsmasq',
+  String  $service_name                      = 'dnsmasq',
+  Stdlib::Absolutepath $config_file          = '/etc/dnsmasq.conf',
+  Stdlib::Absolutepath $config_dir           = '/etc/dnsmasq.d',
+  Boolean $purge_config_dir                  = false,
+  Array[String] $interfaces                  = [],
+  Array[Stdlib::IP::Address] $listen_addresses = ['127.0.0.1'],
+  Enum['bind-interfaces', 'bind-dynamic', 'none'] $bind_mode = 'bind-interfaces',
+  Boolean $no_resolv                         = false,
+  Array[String] $servers                     = [],
+  Hash[String, Array[String]] $forwards      = {},
+  Optional[Integer[0]] $cache_size           = undef,
+  Boolean $domain_needed                     = true,
+  Boolean $bogus_priv                        = true,
+  Array[String] $dhcp_relays                 = [],
+  Array[String] $options                     = [],
+) {
+
+  if $manage_package {
+    package { $package_name:
+      ensure => installed,
+      before => File[$config_file, $config_dir],
+    }
+  }
+
+  file { $config_dir:
+    ensure  => directory,
+    recurse => $purge_config_dir,
+    purge   => $purge_config_dir,
+  }
+
+  file { $config_file:
+    ensure  => file,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('dnsmasq/dnsmasq.conf.erb'),
+  }
+
+  if $manage_service {
+    service { $service_name:
+      ensure    => running,
+      enable    => true,
+      subscribe => File[$config_file, $config_dir],
+    }
+  }
+}
diff --git a/modules/dnsmasq/templates/dnsmasq.conf.erb b/modules/dnsmasq/templates/dnsmasq.conf.erb
new file mode 100644
index 0000000..c5a09ae
--- /dev/null
+++ b/modules/dnsmasq/templates/dnsmasq.conf.erb
@@ -0,0 +1,40 @@
+# THIS FILE IS MANAGED BY PUPPET
+user=dnsmasq
+group=dnsmasq
+conf-dir=<%= @config_dir %>,.rpmnew,.rpmsave,.rpmorig
+
+<% @interfaces.each do |iface| -%>
+interface=<%= iface %>
+<% end -%>
+<% unless @listen_addresses.empty? -%>
+listen-address=<%= @listen_addresses.join(',') %>
+<% end -%>
+<% unless @bind_mode == 'none' -%>
+<%= @bind_mode %>
+<% end -%>
+<% if @no_resolv -%>
+no-resolv
+<% end -%>
+<% if @domain_needed -%>
+domain-needed
+<% end -%>
+<% if @bogus_priv -%>
+bogus-priv
+<% end -%>
+<% if @cache_size -%>
+cache-size=<%= @cache_size %>
+<% end -%>
+<% @servers.each do |server| -%>
+server=<%= server %>
+<% end -%>
+<% @forwards.keys.sort.each do |domain| -%>
+<% @forwards[domain].each do |server| -%>
+server=/<%= domain %>/<%= server %>
+<% end -%>
+<% end -%>
+<% @dhcp_relays.each do |relay| -%>
+dhcp-relay=<%= relay %>
+<% end -%>
+<% @options.each do |line| -%>
+<%= line %>
+<% end -%>