Unbound
Unbound is a validating, recursive and caching DNS server designed for high performance. It was released on May 20, 2008 (version 1.0.0) as free software licensed under the BSD license by NLnet Labs, Verisign Inc., Nominet, and Kirei. It is installed as part of the base system in FreeBSD starting with version 10.0, and in NetBSD with version 8.0. A version is also available in OpenBSD version 5.6 and beyond. (Previous versions of FreeBSD shipped with BIND.) The default config file is /usr/local/etc/unbound/unbound.conf in FreeBSD and /etc/unbound/unbound.conf in Linux. Port 53 needs to be open in your router and in the local firewall. A better walkthrough is located here.
DNS Resolving Cache
This can be used as a DNS cache to serve local or external DNS queries. It can also be used to block advertisements.
Custom DNS domains can be set within Unbound as well. This is a basic A record:
local-data: "xboxone.local IN A 192.168.1.139"
A PTR record can also be set for external queries. Please note that your ISP may block these.
local-data-ptr: "68.225.35.119 server.domain.com"
A root hints file is required as well. You can wget this here
In order to block most advertisements, include: is needed. Here is the TBP blackhole.zone file for download. Be sure to include it in the /usr/local/etc/unbound/unbound.conf file. Here's a complete config setup:
## Unbound config file
server:
# Zone file
include: /usr/local/etc/unbound/blackhole.zone
# List of valid clients
port: 53
include: /usr/local/etc/unbound/users.conf
# Enable IPv4, "yes" or "no".
do-ip4: yes
# Enable IPv6, "yes" or "no".
do-ip6: yes
# Enable UDP, "yes" or "no".
do-udp: yes
do-tcp: yes
harden-dnssec-stripped: yes
rrset-cache-size: 2048m
msg-cache-size: 1024m
so-rcvbuf: 1m
val-permissive-mode: yes
# Verbosity to zero - we don't log
verbosity: 0
use-syslog: no
# Specify interfaces
interface: 0.0.0.0
interface: ::0
# Our root hints file
root-hints: /usr/local/etc/unbound/root.hints
auto-trust-anchor-file: "root.key"
# Hide/block identity and version
hide-identity: yes
hide-version: yes
# Trust glue only if it is within the servers authority.
harden-glue: yes
# Require DNSSEC data for trust-anchored zones
harden-dnssec-stripped: yes
# Use 0x20-encoded random bits in the query to help prevent spoofs
use-caps-for-id: yes
# Specify caching TTLs
cache-min-ttl: 360
cache-max-ttl: 8640
# Perform prefetching of close to expired message cache entries.
prefetch: yes
minimal-responses: yes
qname-minimisation: yes
rrset-roundrobin: yes
num-threads: 8
# Do not allow localhost to use the forwarder
do-not-query-localhost: yes
ssl-upstream: yes
# Specify servers for forwarding to
forward-zone:
name:"."
forward-addr: 1.1.1.1@853 #Cloudflare DNS over TLS
forward-addr: 1.0.0.1@853 #Cloudflare DNS over TLS
forward-addr: 9.9.9.9@853 #IBM IPv6 Quad9 over TLS
forward-addr: 149.112.112.112@853 #IBM IPv6 Quad9 over TLS
forward-addr: 2606:4700:4700::1111@853 #IPv6 Cloudflare DNS over TLS
forward-addr: 2606:4700:4700::1001@853 #IPv6 Cloudflare DNS over TLS
# forward-addr: 68.1.16.108
# forward-addr: 68.1.16.107
# forward-addr: 208.67.222.222
# forward-addr: 208.67.220.220
# forward-addr: 172.98.193.42
# forward-addr: 192.99.85.244
# forward-addr: 1.1.1.1 # Cloudflare
# forward-addr: 1.0.0.1 # Cloudflare
# forward-addr: 8.8.4.4 # Google
# forward-addr: 8.8.8.8 # Google
# forward-addr: 37.235.1.174 # FreeDNS
# forward-addr: 37.235.1.177 # FreeDNS
# forward-addr: 64.6.64.6 # Verisign
# forward-addr: 64.6.65.6 # Verisign
# forward-addr: 74.82.42.42 # Hurricane Electric
# forward-addr: 84.200.69.80 # DNS Watch
# forward-addr: 84.200.70.40 # DNS Watch
# forward-addr: 91.239.100.100 # censurfridns.dk
# forward-addr: 109.69.8.51 # puntCAT
# forward-addr: 208.67.222.220 # OpenDNS
# forward-addr: 208.67.222.222 # OpenDNS
# forward-addr: 216.146.35.35 # Dyn Public
# forward-addr: 216.146.36.36 # Dyn Public
remote-control:
# Enable remote control with unbound-control(8) here.
# set up the keys and certificates with unbound-control-setup.
control-enable: yes
# what interfaces are listened to for remote control.
# give 0.0.0.0 and ::0 to listen to all interfaces.
control-interface: 127.0.0.1
# port number for remote control operations.
control-port: 8953
# unbound server key file.
server-key-file: "/usr/local/etc/unbound/unbound_server.key"
# unbound server certificate file.
server-cert-file: "/usr/local/etc/unbound/unbound_server.pem"
# unbound-control key file.
control-key-file: "/usr/local/etc/unbound/unbound_control.key"
# unbound-control certificate file.
control-cert-file: "/usr/local/etc/unbound/unbound_control.pem"
