[Unit]
Description=Contest firewall DNS filter (answers only the allowed names)
After=network.target firewall.service
PartOf=firewall.service
# Started and stopped with firewall.service (no [Install] section on purpose)

[Service]
Type=simple
ExecStart=/usr/sbin/dnsmasq --keep-in-foreground --conf-file=/run/contest-firewall/dnsmasq.conf
Restart=always
RestartSec=2