Unbound: Difference between revisions

← Older edit

VisualWikitext

@@ Line 3: / Line 3: @@
 Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards.
-== Example configuration ==
+== Minimal configuration. DNS resolver ==
+In this case our DNS queries are not encrypted upstream because the internet root name servers do not support DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH).
+<syntaxhighlight lang="nixos">
+services.unbound = {
+  enable = true;
+  # next line is optional (RFC7816)
+  settings.server.qname-minimisation = true;
+};
+</syntaxhighlight>
+Test if it's working
+<syntaxhighlight>
+$ nslookup nixos.org localhost
+$ systemctl status unbound.service
+$ cat /etc/unbound/unbound.conf
+</syntaxhighlight>
+If during the configuration our computer stops resolving DNS and we lose connectivity, we can manually set the line <code>nameserver 9.9.9.9</code> doing <code>sudo nano /etc/resolv.conf</code>. Now we can rebuild our system.
+== DNS forwarder with blocklists ==
+In this configuration we are using DoT to reach Quad9 and Cloudflare public DNS resolvers, in addition, we are filtering the results with a list that blocks adds and improves privacy and security (as Pi-hole does).
 <syntaxhighlight lang="nixos">
 services.unbound = {
-    enable = true;
+  enable = true;
-    settings = {
-      server = {
-        # When only using Unbound as DNS, make sure to replace 127.0.0.1 with your ip address
-        # When using Unbound in combination with pi-hole or Adguard, leave 127.0.0.1, and point Adguard to 127.0.0.1:PORT
-        interface = [ "127.0.0.1" ];
-        port = 5335;
-        access-control = [ "127.0.0.1 allow" ];
-        # Based on recommended settings in https://docs.pi-hole.net/guides/dns/unbound/#configure-unbound
-        harden-glue = true;
-        harden-dnssec-stripped = true;
-        use-caps-for-id = false;
-        prefetch = true;
-        edns-buffer-size = 1232;
-        # Custom settings
+  settings.server = {
-        hide-identity = true;
+    # Our Unbound server IP
-        hide-version = true;
+    interface = [ "192.168.1.2" ];
-      };
+    # IPs allowed to query
-      forward-zone = [
+    access-control = [ "192.168.1.0/24 allow" ];
-        # Example config with quad9
+    # Enable RPZ
-        {
+     module-config = "'respip validator iterator'";
-          name = ".";
-          forward-addr = [
-            "9.9.9.9#dns.quad9.net"
-            "149.112.112.112#dns.quad9.net"
-          ];
-          forward-tls-upstream = true;  # Protected DNS
-        }
-      ];
-     };
    };
+  settings.rpz = [{
+    name = "hageziPro";
+    url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt";
+  }];
+  settings.forward-zone = [{
+    name = ".";
+    forward-tls-upstream = true;
+    forward-addr = [
+      "9.9.9.9@853#dns.quad9.net"
+      "149.112.112.112@853#dns.quad9.net"
+      "1.1.1.1@853#cloudflare-dns.com"
+      "1.0.0.1@853#cloudflare-dns.com"
+    ];
+  }];
+};
 </syntaxhighlight>