computing:unbounddns
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| computing:unbounddns [2024/11/01 04:23] – oemb1905 | computing:unbounddns [2025/09/20 18:37] (current) – oemb1905 | ||
|---|---|---|---|
| Line 14: | Line 14: | ||
| sudo apt install unbound | sudo apt install unbound | ||
| - | sudo nano / | + | sudo nano / |
| + | sudo nano / | ||
| | | ||
| In that file, enter something like the following, adjusting as necessary for your use-case. | In that file, enter something like the following, adjusting as necessary for your use-case. | ||
| + | | ||
| server: | server: | ||
| - | logfile: "/ | + | # Logging (minimal) |
| - | log-time-ascii: | + | use-syslog: yes |
| - | use-syslog: yes | + | |
| - | directory: "/ | + | |
| - | username: unbound | + | username: unbound |
| - | tls-cert-bundle: | + | # Bind to all interfaces, non-standard port |
| - | verbosity: 3 | + | interface: 0.0.0.0 |
| - | interface: 0.0.0.0 | + | interface: ::0 |
| - | interface: ::0 | + | port: 5335 |
| - | port: 5335 | + | do-ip4: yes |
| - | do-ip4: yes | + | |
| - | do-udp: yes | + | prefer-ip6: no |
| - | do-tcp: yes | + | |
| - | module-config: | + | do-tcp: yes |
| - | | + | # Module configuration |
| - | prefer-ip6: no | + | |
| - | harden-glue: | + | # Security and DNSSEC |
| - | harden-dnssec-stripped: | + | harden-glue: |
| - | use-caps-for-id: | + | harden-dnssec-stripped: |
| - | edns-buffer-size: 1232 | + | use-caps-for-id: |
| - | | + | |
| - | num-threads: 8 | + | hide-identity: yes |
| - | msg-cache-slabs: 16 | + | |
| - | rrset-cache-slabs: 16 | + | qname-minimisation: yes |
| - | infra-cache-slabs: 16 | + | |
| - | key-cache-slabs: 16 | + | # Cache settings |
| - | rrset-cache-size: | + | |
| - | msg-cache-size: 256m | + | |
| - | outgoing-range: | + | |
| - | num-queries-per-thread: | + | msg-cache-size: 128m |
| - | infra-cache-numhosts: | + | key-cache-size: 64m |
| - | #so-rcvbuf: 1m | + | neg-cache-size: |
| - | #so-sndbuf: 2m | + | # Performance tweaks |
| - | so-reuseport: | + | num-threads: |
| - | private-address: | + | |
| - | private-address: | + | |
| - | | + | infra-cache-slabs: |
| - | | + | key-cache-slabs: |
| - | private-address: | + | |
| - | private-address: | + | num-queries-per-thread: |
| - | # | + | infra-cache-numhosts: |
| - | #access-control: | + | |
| - | # | + | prefetch-key: yes |
| - | access-control: | + | serve-expired: yes |
| - | | + | serve-expired-ttl: |
| - | | + | so-reuseport: |
| - | access-control: | + | |
| - | aggressive-nsec: | + | # Block private address ranges (excluding guest subnet) |
| - | hide-identity: | + | |
| - | hide-version: | + | private-address: |
| - | cache-max-ttl: | + | private-address: |
| - | cache-min-ttl: | + | private-address: |
| + | private-address: | ||
| + | # Access control for guest subnet | ||
| + | | ||
| + | access-control: | ||
| + | access-control: | ||
| + | |||
| + | If using unbound with a pihole, let ''/ | ||
| + | |||
| + | domain domain.com | ||
| + | | ||
| + | nameserver 192.168.1.254 | ||
| | | ||
| In my case, I prefer traditional rotated logs with rsyslog, so I do the following: | In my case, I prefer traditional rotated logs with rsyslog, so I do the following: | ||
| Line 78: | Line 90: | ||
| <if $programname == ' | <if $programname == ' | ||
| <& stop> | <& stop> | ||
| + | nano / | ||
| + | | ||
| + | In the log rotate file, enter the following: | ||
| + | |||
| + | / | ||
| + | daily | ||
| + | rotate 7 | ||
| + | missingok | ||
| + | create 0640 root adm | ||
| + | postrotate | ||
| + | / | ||
| + | endscript | ||
| + | } | ||
| Additionally, | Additionally, | ||
| Line 95: | Line 120: | ||
| sudo chown unbound / | sudo chown unbound / | ||
| | | ||
| - | Enforce edns settings specified in config: | + | Enforce edns settings specified in config |
| nano / | nano / | ||
| < | < | ||
| - | The last step is configuring the unbound server in the pihole GUI. Alternately, you can do this without a pihole | + | The last step is configuring the unbound server in the pihole GUI. Go to DNS > Custom and then add '' |
| + | |||
| + | {{ : | ||
| + | {{ : | ||
| + | {{ : | ||
| + | |||
| + | Okay, that concludes the steps for setting up pihole+unbound within an openWRT environment. However, one might also want to leverage unbound for public-facing machines. For those use-cases, I enter the following config in ''/ | ||
| + | |||
| + | server: | ||
| + | # Bind to localhost only | ||
| + | interface: 127.0.0.1 | ||
| + | interface: ::1 | ||
| + | port: 53 | ||
| + | do-ip4: yes | ||
| + | do-ip6: yes | ||
| + | prefer-ip6: yes | ||
| + | access-control: | ||
| + | access-control: | ||
| + | access-control: | ||
| + | # Optimize for 8 cores | ||
| + | num-threads: | ||
| + | msg-cache-slabs: | ||
| + | rrset-cache-slabs: | ||
| + | infra-cache-slabs: | ||
| + | key-cache-slabs: | ||
| + | # Cache settings for high query volume | ||
| + | cache-max-ttl: | ||
| + | cache-min-ttl: | ||
| + | rrset-cache-size: | ||
| + | msg-cache-size: | ||
| + | key-cache-size: | ||
| + | neg-cache-size: | ||
| + | # Enable prefetch and expired responses | ||
| + | prefetch: yes | ||
| + | prefetch-key: | ||
| + | serve-expired: | ||
| + | serve-expired-ttl: | ||
| + | # DNSSEC validation for DANE | ||
| + | #do-dnssec: yes | ||
| + | harden-dnssec-stripped: | ||
| + | harden-referral-path: | ||
| + | harden-below-nxdomain: | ||
| + | harden-algo-downgrade: | ||
| + | # Performance tweaks | ||
| + | #so-rcvbuf: 4m | ||
| + | #so-sndbuf: 4m | ||
| + | edns-buffer-size: | ||
| + | outgoing-range: | ||
| + | num-queries-per-thread: | ||
| + | jostle-timeout: | ||
| + | # | ||
| + | # Logging (minimal) | ||
| + | verbosity: 1 | ||
| + | log-queries: | ||
| + | log-replies: | ||
| + | use-syslog: yes | ||
| + | # Security and privacy | ||
| + | hide-identity: | ||
| + | hide-version: | ||
| + | use-caps-for-id: | ||
| + | qname-minimisation: | ||
| + | harden-large-queries: | ||
| + | harden-glue: | ||
| + | aggressive-nsec: | ||
| + | # Protocol settings | ||
| + | do-tcp: yes | ||
| + | do-udp: yes | ||
| + | # Enable full recursion - no longer needed, retained for history | ||
| + | # do-not-query-localhost: | ||
| + | # root-hints: "/ | ||
| + | # Disable subnetcache | ||
| + | module-config: | ||
| + | # Forward to upstream resolvers | ||
| + | # forward-zone: | ||
| + | # name: " | ||
| + | # forward-addr: | ||
| + | # forward-addr: | ||
| + | |||
| + | After that, I navigate to ''/ | ||
| + | |||
| + | nameserver ::1 | ||
| + | nameserver 127.0.0.1 | ||
| + | |||
| + | And, as we already discussed, if you are using unbound without a pihole per se, you would simply adapt the lan-side configuration above and tweak where necessary. | ||
| - | --- //[[webmaster@haacksnetworking.org|oemb1905]] | + | --- //[[alerts@haacksnetworking.org|oemb1905]] |
computing/unbounddns.1730435001.txt.gz · Last modified: by oemb1905
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
