Unbound: Difference between revisions
Correcting typos, improving explanations and adding options |
Typo |
||
| Line 10: | Line 10: | ||
services.unbound = { | services.unbound = { | ||
enable = true; | enable = true; | ||
# | # next line is optional (RFC7816) | ||
settings.server.qname-minimisation = true; | settings.server.qname-minimisation = true; | ||
}; | }; | ||
Revision as of 11:29, 24 March 2026
Unbound is a DNS server. Quoting the official project page:
Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards.
Minimal configuration. DNS resolver
In this case our DNS queries are not encrypted upstream because the root servers do not support DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH).
services.unbound = {
enable = true;
# next line is optional (RFC7816)
settings.server.qname-minimisation = true;
};
Test if it's working
$ nslookup nixos.org localhost
$ systemctl status unbound.service
$ cat /etc/unbound/unbound.confIf during the configuration our computer stops resolving DNS and we lose connectivity, we can manually set the line nameserver 9.9.9.9 doing sudo nano /etc/resolv.conf. Now we can rebuild our system.
DNS forwarder with blocklists
In this configuration we are using DoT to Quad9 and Cloudflare public DNS resolvers, plus, we are applying an Ad blocker list (as Pi-hole does).
services.unbound = {
enable = true;
settings.server = {
# Our Unbound server IP
interface = [ "192.168.1.2" ];
# IPs allowed to query
access-control = [ "192.168.1.0/24" allow ];
# Enable RPZ
module.config = "'respip validator iterator'";
};
settings.rpz = [{
name = "hageziPro";
url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt";
}]
settings.forward-zone = [{
name = ".";
forward-tls-upstream = true;
forward-addr = [
"9.9.9.9@853#dns.quad9.net";
"149.112.112.112@853#dns.quad9.net"
"1.1.1.1@853#cloudflare-dns.com";
"1.0.0.1@853#cloudflare-dns.com";
]
}];
};