Unbound - Revision history

Deathbybandaid: /* Conf file */

2021-12-09T19:11:47Z

Conf file

← Older revision		Revision as of 19:11, 9 December 2021
Line 126:		Line 126:
	# all interfaces		# all interfaces
	interface: 0.0.0.0		interface: 0.0.0.0
	interface: ::0		interface:e::0

	port: 53		port: 53
Line 176:		Line 176:
	private-address: fe80::/10		private-address: fe80::/10

			# Allow access from local IP ranges
			access-control: 192.168.0.0/16 allow
			access-control: 169.254.0.0/16 allow
			access-control: 172.16.0.0/12 allow
			access-control: 10.0.0.0/8 allow
			access-control: fd00::/8 allow
			access-control: fe80::/10 allow

			# Allow access all IP ranges
			#access-control: 0.0.0.0/0 allow
	If you run into issues with Plex Rebind feel free to add		If you run into issues with Plex Rebind feel free to add
	<nowiki>		<nowiki>

Deathbybandaid: /* Conf file */

2021-12-09T17:40:26Z

Conf file

← Older revision		Revision as of 17:40, 9 December 2021
Line 52:		Line 52:
	<nowiki>DNS=127.0.0.1</nowiki>		<nowiki>DNS=127.0.0.1</nowiki>
	===For Use With Pi-Hole===		===For Use With Pi-Hole===
	====Root Hints Updating====
			==== Root Hints from Package Manager ====
			If you have `dns-root-data` installed skip the below script.

			====Root Hints Updating By Script====
	<nowiki>nano /home/root_hints_update.sh</nowiki>		<nowiki>nano /home/root_hints_update.sh</nowiki>

Line 114:		Line 118:
	<nowiki>nano /etc/unbound/unbound.conf.d/pi-hole.conf</nowiki>		<nowiki>nano /etc/unbound/unbound.conf.d/pi-hole.conf</nowiki>

	~~<nowiki>~~
	~~server:~~
	~~# If no logfile is specified, syslog is used~~
	~~# logfile: "/var/log/unbound/unbound.log"~~
	~~verbosity: 0~~

	~~# all interfaces~~
	~~interface: 0.0.0.0~~
	~~interface: ::0~~

	~~port: 53~~
	~~do-ip4: yes~~
	~~do-udp: yes~~
	~~do-tcp: yes~~

	~~# May be set to yes if you have IPv6 connectivity~~
	~~do-ip6: no~~

	~~# Use this only when you downloaded the list of primary root servers!~~
	~~root-hints: "/var/lib/unbound/root.hints"~~

	~~# Trust glue only if it is within the servers authority~~
	~~harden-glue: yes~~

	# ~~Require DNSSEC data for trust-anchored zones~~, ~~if such data~~ is ~~absent, the zone becomes BOGUS~~		server:
	~~harden~~-~~dnssec~~-~~stripped~~: yes		# If no logfile is specified, syslog is used
			# logfile: "/var/log/unbound/unbound.log"
			verbosity: 0

			# all interfaces
			interface: 0.0.0.0
			interface: ::0

			port: 53
			do-ip4: yes
			do-udp: yes
			do-tcp: yes

			# May be set to yes if you have IPv6 connectivity
			do-ip6: no

			# Use this only when you downloaded the list of primary root servers!
			root-hints: "/var/lib/unbound/root.hints" # If using above script
			#/usr/share/dns/root.hints from package maintainer

	# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes		# Trust glue only if it is within the servers authority
	# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details		harden-glue: yes
	use-caps-for-id: no
			# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
	# Reduce EDNS reassembly buffer size.		harden-dnssec-stripped: yes
	# Suggested by the unbound man page to reduce fragmentation reassembly problems
	edns-buffer-size: 1472		# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
			# see <nowiki>https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378</nowiki> for further details
	# TTL bounds for cache		use-caps-for-id: no
	cache-min-ttl: 3600
	cache-max-ttl: 86400		# Reduce EDNS reassembly buffer size.
			# Suggested by the unbound man page to reduce fragmentation reassembly problems
	# Perform prefetching of close to expired message cache entries		edns-buffer-size: 1472
	# This only applies to domains that have been frequently queried
	prefetch: yes		# TTL bounds for cache
			cache-min-ttl: 3600
	# One thread should be sufficient, can be increased on beefy machines		cache-max-ttl: 86400
	num-threads: 1
			# Perform prefetching of close to expired message cache entries
	# Ensure kernel buffer is large enough to not loose messages in traffic spikes		# This only applies to domains that have been frequently queried
	so-rcvbuf: 1m		prefetch: yes

	# Ensure privacy of local IP ranges		# One thread should be sufficient, can be increased on beefy machines
	private-address: 192.168.0.0/16		num-threads: 1
	private-address: 169.254.0.0/16
	private-address: 172.16.0.0/12		# Ensure kernel buffer is large enough to not loose messages in traffic spikes
	private-address: 10.0.0.0/8		so-rcvbuf: 1m
	private-address: fd00::/8
	private-address: fe80::/10		# Ensure privacy of local IP ranges
			private-address: 192.168.0.0/16
	~~</nowiki>~~		private-address: 169.254.0.0/16
			private-address: 172.16.0.0/12
			private-address: 10.0.0.0/8
			private-address: fd00::/8
			private-address: fe80::/10


	If you run into issues with Plex Rebind feel free to add		If you run into issues with Plex Rebind feel free to add
	<nowiki>		<nowiki>

Deathbybandaid: Created page with " =Opening Disclaimers= ==Proxmox== This Guide is written based on the use of Proxmox-VE version 7.0 and more specifically Proxmox_LXC. These instructions should be adaptable to other situations. ===Container Creation=== ====General==== Unpriviliged container: checked Nesting: unchecked ====Template==== Template: ubuntu-21.04-standard_21.04-1_amd64 ====Disks==== Disk Size (GiB): 4 ====CPU==== Cores: 1 ====Memory==== Memory (MiB): 256 Swap (MiB): 512 ====Netw..."

2021-12-08T20:21:15Z

Created page with " =Opening Disclaimers= ==Proxmox== This Guide is written based on the use of Proxmox-VE version 7.0 and more specifically Proxmox_LXC. These instructions should be adaptable to other situations. ===Container Creation=== ====General==== *Unpriviliged container: checked *Nesting: unchecked ====Template==== *Template: ubuntu-21.04-standard_21.04-1_amd64 ====Disks==== *Disk Size (GiB): 4 ====CPU==== Cores: 1 ====Memory==== *Memory (MiB): 256 *Swap (MiB): 512 ====Netw..."

New page

=Opening Disclaimers=
==Proxmox==
This Guide is written based on the use of [[Proxmox-VE]] version 7.0 and more specifically [[Proxmox_LXC]]. These instructions should be adaptable to other situations.
===Container Creation===
====General====
*Unpriviliged container: checked
*Nesting: unchecked
====Template====
*Template: ubuntu-21.04-standard_21.04-1_amd64
====Disks====
*Disk Size (GiB): 4
====CPU====
Cores: 1
====Memory====
*Memory (MiB): 256
*Swap (MiB): 512
====Network====
*IPv4 Static
*IPv4 Gateway
====DNS====
*DNS Servers: 8.8.8.8 (Change to 127.0.0.1 post-install)
====Confirm====
*Start After Created: unchecked
===Container Tweaks===
====Options====
*Start at boot: yes
===Container First Run Steps===
Run Updates
<nowiki>apt update && apt full-upgrade -y</nowiki>
Add a sudo user
<nowiki>adduser sysop</nowiki>
<nowiki>usermod -aG sudo sysop</nowiki>
Cleanup The Container for some easy space savings.
<nowiki>apt autoremove -y && apt clean -y</nowiki>
=Unbound Installation=
==My Insights==
*It's good practice to have both 2 instances of Unbound, so you can update one at a time, and still have DNS for your home network. You can either follow this guide twice, or clone the container.
==Prerequisite Guide(s)==
==Dependency Installs==
==Unbound Installation==
<nowiki>apt install unbound</nowiki>
Let's free up port 53 from systemd-resolved
<nowiki>nano /etc/systemd/resolved.conf</nowiki>
Change
<nowiki>#DNSStubListener=yes</nowiki>
To
<nowiki>DNSStubListener=no</nowiki>
Change
<nowiki>#DNS=</nowiki>
To
<nowiki>DNS=127.0.0.1</nowiki>
===For Use With Pi-Hole===
====Root Hints Updating====
<nowiki>nano /home/root_hints_update.sh</nowiki>

<nowiki>

#!/bin/bash

ROOTSURL=https://www.internic.net/domain/named.root
CURRENTROOTS=/var/lib/unbound/root.hints
TEMPROOTS=/tmp/root.hints
DOWNLOADFRESH=false

if [[ -f $CURRENTROOTS ]]
then
echo "Checking existing file"
SOURCEMODIFIEDLAST=$(curl --silent --head $ROOTSURL | awk -F: '/^Last-Modified/ { print $2 }')
SOURCEMODIFIEDTIME=$(date --date="$SOURCEMODIFIEDLAST" +%s)
LOCALFILEMODIFIEDLAST=$(stat -c %z "$CURRENTROOTS")
LOCALFILEMODIFIEDTIME=$(date --date="$LOCALFILEMODIFIEDLAST" +%s)
if [[ $LOCALFILEMODIFIEDTIME -lt $SOURCEMODIFIEDTIME ]]
then
DOWNLOADFRESH=true
echo "File updated online"
else
echo "File not updated online"
fi
else
DOWNLOADFRESH=true
echo "File Missing"
fi

if [[ $DOWNLOADFRESH = true ]]
then
echo "Attempting to download file"
wget -O $TEMPROOTS $ROOTSURL
FETCHFILESIZE=$(stat -c%s $TEMPROOTS)
if [[ $FETCHFILESIZE -gt 0 ]]
then
mv $TEMPROOTS $CURRENTROOTS
else
echo "File download failed"
fi
else
echo "Not downloading file"
fi

# restart unbound
if [[ $DOWNLOADFRESH = true ]]
then
service unbound restart
fi
</nowiki>

<nowiki>bash /home/root_hints_update.sh</nowiki>

<nowiki>crontab -e</nowiki>

<nowiki>0 0 * * 0 /bin/bash /home/root_hints_update.sh</nowiki>
====Conf file====
<nowiki>nano /etc/unbound/unbound.conf.d/pi-hole.conf</nowiki>

<nowiki>
server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
verbosity: 0

# all interfaces
interface: 0.0.0.0
interface: ::0

port: 53
do-ip4: yes
do-udp: yes
do-tcp: yes

# May be set to yes if you have IPv6 connectivity
do-ip6: no

# Use this only when you downloaded the list of primary root servers!
root-hints: "/var/lib/unbound/root.hints"

# Trust glue only if it is within the servers authority
harden-glue: yes

# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes

# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no

# Reduce EDNS reassembly buffer size.
# Suggested by the unbound man page to reduce fragmentation reassembly problems
edns-buffer-size: 1472

# TTL bounds for cache
cache-min-ttl: 3600
cache-max-ttl: 86400

# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes

# One thread should be sufficient, can be increased on beefy machines
num-threads: 1

# Ensure kernel buffer is large enough to not loose messages in traffic spikes
so-rcvbuf: 1m

# Ensure privacy of local IP ranges
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10

</nowiki>
If you run into issues with Plex Rebind feel free to add
<nowiki>
# Plex Rebind fix
private-domain: plex.direct
</nowiki>

<nowiki>service unbound restart</nowiki>