Difference between revisions of "Setting up unbound DNS server"
|Line 19:||Line 19:|
# interface: 0.0.0.0
# interface: 0.0.0.0
Revision as of 09:31, 3 March 2014
Unbound is a validating, recursive, and caching DNS resolver that supports DNSSEC.
The following configuration is an example of a caching name server (in a production server, it's recommended to adjust the access-control parameter to limit access to your network). The forward-zone(s) section will forward all DNS queries to the specified servers. Don't forget to change the 'interface' parameter to one of your local interfaces (or 0.0.0.0 to listen on all local IPv4 interfaces). The following is a minimal example with many options commented out.
server: verbosity: 1 ## Specify the interface address to listen on: interface: 10.0.0.1 ## To listen on all interfaces use: # interface: 0.0.0.0 do-ip4: yes do-ip6: yes do-udp: yes do-tcp: yes do-daemonize: yes access-control: 0.0.0.0/0 allow ## Other access control examples #access-control: 192.168.1.0/24 action ## 'action' should be replaced by any one of: #deny (drop message) #refuse (sends a DNS rcode REFUSED error message back) #allow (recursive ok) #allow_snoop (recursive and nonrecursive ok). ## Minimum lifetime of cache entries in seconds. Default is 0. #cache-min-ttl: 60 ## Maximum lifetime of cached entries. Default is 86400 seconds (1 day). #cache-max-ttl: 172800 ## enable to not answer id.server and hostname.bind queries. hide-identity: yes ## enable to not answer version.server and version.bind queries. hide-version: yes ## default is to use syslog, which will log to /var/log/messages. use-syslog: yes ## to log elsewhere, set 'use-syslog' to 'no' and set the log file location below: #logfile: /var/log/unbound python: remote-control: control-enable: no ## Stub zones are like forward zones (see below) but must only contain authority server (no recursive servers) #stub-zone: # name: "my.test.com" # stub-addr: 172.16.1.1 # stub-addr: 172.16.1.2 ## Note for forward zones, the destination servers must be able to handle recursion to other DNS server ## Forward all *.example.com queries to the server at 192.168.1.1 #forward-zone: # name: "example.com" # forward-addr: 192.168.1.1 ## Forward all other queries to the Verizon DNS servers forward-zone: name: "." ## Level3 Verizon forward-addr: 220.127.116.11 forward-addr: 18.104.22.168
Instead of forwarding queries to a public DNS server, you may prefer to query the root DNS servers. To do this, comment out the forwarding entries in the config. Then, grab the latest root hints file using wget:
And finally point unbound to the root hints file by adding the following line to the server section of the unbound config file:
Restart unbound to ensure the changes take effect. You may wish to setup a cron job to update the root hints file occasionally.
Set auto-start, start and test the daemon
Check the configuration for errors:
and if no errors are reported, set to auto-start then start unbound:
Test, for example: