68 lines
1.9 KiB
Text
68 lines
1.9 KiB
Text
|
# /var/unbound/etc/unbound.conf — recursive DNS resolver
|
||
|
|
#
|
||
|
|
# Listens on:
|
||
|
|
# 127.0.0.1:53 — for local apps (acme-client, relayd)
|
||
|
|
# 10.10.10.1:53 — for nullstone over WG tunnel
|
||
|
|
# 192.168.0.50:53 — for LAN clients (LAN IP of T5600; adjust)
|
||
|
|
#
|
||
|
|
# Pi-hole stays on the Pi for LAN ad-blocking; Pi-hole's upstream is set
|
||
|
|
# to THIS unbound instance (10.10.10.1 via tunnel OR LAN IP direct).
|
||
|
|
#
|
||
|
|
# Reload: rcctl reload unbound
|
||
|
|
# Test: dig @127.0.0.1 example.com
|
||
|
|
|
||
|
|
server:
|
||
|
|
interface: 127.0.0.1
|
||
|
|
interface: 10.10.10.1
|
||
|
|
interface: 192.168.0.50
|
||
|
|
|
||
|
|
# Restrict who can query
|
||
|
|
access-control: 127.0.0.0/8 allow
|
||
|
|
access-control: 10.10.10.0/29 allow # WG mesh
|
||
|
|
access-control: 192.168.0.0/24 allow # LAN
|
||
|
|
access-control: 0.0.0.0/0 refuse # block public recursive abuse
|
||
|
|
|
||
|
|
# Hide identity
|
||
|
|
hide-identity: yes
|
||
|
|
hide-version: yes
|
||
|
|
|
||
|
|
# Cache + perf
|
||
|
|
msg-cache-size: 64m
|
||
|
|
rrset-cache-size: 128m
|
||
|
|
cache-min-ttl: 60
|
||
|
|
cache-max-ttl: 86400
|
||
|
|
prefetch: yes
|
||
|
|
prefetch-key: yes
|
||
|
|
|
||
|
|
# DNSSEC validation
|
||
|
|
auto-trust-anchor-file: "/var/unbound/db/root.key"
|
||
|
|
val-clean-additional: yes
|
||
|
|
|
||
|
|
# Privacy
|
||
|
|
qname-minimisation: yes
|
||
|
|
aggressive-nsec: yes
|
||
|
|
minimal-responses: yes
|
||
|
|
do-not-query-localhost: no # allow forwarding to local Pi-hole if you do that later
|
||
|
|
|
||
|
|
# Drop common bogus
|
||
|
|
private-address: 10.0.0.0/8
|
||
|
|
private-address: 172.16.0.0/12
|
||
|
|
private-address: 192.168.0.0/16
|
||
|
|
# ... but allow our own ranges to be returned in answers
|
||
|
|
private-domain: "s8n.ru"
|
||
|
|
private-domain: "veilor.uk"
|
||
|
|
|
||
|
|
# Local zone for internal hosts (nullstone, edge, etc.) — fill from /etc/hosts
|
||
|
|
local-zone: "s8n.ru." typetransparent
|
||
|
|
local-data: "edge.s8n.ru. IN A 10.10.10.1"
|
||
|
|
local-data: "nullstone.s8n.ru. IN A 10.10.10.2"
|
||
|
|
|
||
|
|
# Logs
|
||
|
|
use-syslog: yes
|
||
|
|
log-queries: no
|
||
|
|
log-replies: no
|
||
|
|
|
||
|
|
remote-control:
|
||
|
|
control-enable: yes
|
||
|
|
control-interface: /var/run/unbound.sock
|