-
-
Notifications
You must be signed in to change notification settings - Fork 6
Expand file tree
/
Copy pathunbound.conf
More file actions
362 lines (351 loc) · 12.6 KB
/
Copy pathunbound.conf
File metadata and controls
362 lines (351 loc) · 12.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
# See unbound.conf(5) man page.
# https://nlnetlabs.nl/documentation/unbound/unbound.conf/
# https://raw.githubusercontent.com/NLnetLabs/unbound/master/doc/example.conf.in
#
# Use this to include other text into the file.
# include: "otherfile.conf"
server:
#### Options already enabled by default:
## https://tools.ietf.org/html/rfc7816
# qname-minimisation: yes
### Enabled in v1.8.0
# so-reuseport: yes
# minimal-responses: yes
## https://tools.ietf.org/html/rfc8020
# harden-below-nxdomain: yes
####
## new option in v1.7.3
# https://tools.ietf.org/html/rfc7828
edns-tcp-keepalive: yes
# edns-tcp-keepalive-timeout: 120000 # 2min
# tcp-idle-timeout: 30000 # 30 sec
edns-buffer-size: 1232
## New Options in v1.8.0
serve-expired-ttl: 86400 # max 1 day
#serve-expired-ttl-reset: no
#log-servfail: no
## new option in v1.8.2
# This responds with an empty message to queries of type ANY.
deny-any: yes
# unknown-server-time-limit: 376
# min-client-subnet-ipv6: 0
# min-client-subnet-ipv4: 0
# max-ecs-tree-size-ipv4: 100
# max-ecs-tree-size-ipv6 : 100
# unknown-server-time-limit: 376
# fast-server-permil: 0
# fast-server-num: 3
# http://unbound.nlnetlabs.nl/documentation/howto_optimise.html
# https://unbound.net/pipermail/unbound-users/2010-March/001083.html
# https://github.com/jedisct1/dnscrypt-server-docker/blob/master/unbound.sh
num-threads: 1
msg-cache-slabs: 1
rrset-cache-slabs: 1
key-cache-slabs: 1
infra-cache-slabs: 1
# dnscrypt-shared-secret-cache-slabs: 1
# dnscrypt-nonce-cache-slabs:1
msg-cache-size: 96m # default 4m
rrset-cache-size: 192m # rrset=msg*2 # default 4m
key-cache-size: 16m # DNSSEC keys default 4m
neg-cache-size: 8m # negative entries default 1m
infra-cache-numhosts: 50000
# dnscrypt-shared-secret-cache-size: 13m # default 4m
# dnscrypt-nonce-cache-size: 13m # default 4m
## if--with-libevent
# outgoing-range: 8192.0
# num-queries-per-thread: 4096.0
## else
# outgoing-range: 974.0
# num-queries-per-thread: 487.0
## Larger socket buffer. OS may need config.
# so-rcvbuf: 4m
# so-sndbuf: 4m
domain-insecure: "dns.opennic.glue"
domain-insecure: "bbs"
domain-insecure: "bit"
domain-insecure: "chan"
domain-insecure: "cyb"
domain-insecure: "dyn"
domain-insecure: "epic"
# domain-insecure: "free"
domain-insecure: "fur"
domain-insecure: "geek"
domain-insecure: "gopher"
domain-insecure: "indy"
domain-insecure: "libre"
domain-insecure: "neo"
domain-insecure: "null"
domain-insecure: "o"
domain-insecure: "opennic.glue"
domain-insecure: "oss"
domain-insecure: "oz"
domain-insecure: "parody"
domain-insecure: "pirate"
domain-insecure: "glue"
domain-insecure: "bazar"
domain-insecure: "coin"
domain-insecure: "emc"
domain-insecure: "lib"
domain-insecure: "ku"
domain-insecure: "te"
domain-insecure: "ti"
domain-insecure: "uu"
verbosity: 0
do-ip6: no
logfile: run/unbound.log
auto-trust-anchor-file: run/root.key
tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
root-hints: root.hints
pidfile: run/unbound.pid
username: _unbound
directory: /etc/unbound
chroot: /etc/unbound
# use-syslog: yes
log-time-ascii: yes
# val-log-level: 0
# statistics-interval: 0
# memory usage stats https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound-control.html#extended-statistics
extended-statistics: yes
# statistics-cumulative: no
interface: 0.0.0.0
# interface: 127.0.0.1
# interface: ::1 # Docker ipv6 -> can't bind socket: Address not available for ::1
# interface: 10.19.96.4
# DNS-over-QUIC (UDP/853) + DNS-over-TLS (TCP/853). Needs unbound built --with-libngtcp2.
interface: 0.0.0.0@853
# interface: ::0@853
# Plaintext DoT backend from haproxy. haproxy terminates TLS and forwards the
# query here wrapped in PROXYv2, so unbound recovers the real client IP (for
# ACL/RPZ/ip-ratelimit). Kept off :53 because the DoH backend (m13253-doh)
# talks plain DNS to :53 and must NOT speak PROXYv2.
interface: 0.0.0.0@5353
port: 53
proxy-protocol-port: 5353
# acme cert volume is mounted at /etc/unbound/ssl; paths are relative to
# directory: /etc/unbound (same convention as root-hints/pidfile above) so
# they resolve correctly inside the chroot, including on reload.
tls-service-key: "ssl/key-ecc.pem"
tls-service-pem: "ssl/fullchain-ecc.pem"
tls-port: 853
access-control: 0.0.0.0/0 allow
access-control: ::/0 allow
# qname-minimisation-strict : yes
# https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
# use-caps-for-id: yes
# caps-whitelist: example.com
# https://tools.ietf.org/html/draft-ietf-dnsop-nsec-aggressiveuse
aggressive-nsec: yes
local-zone: example. static
local-zone: local. static
local-zone: i2p. static
local-zone: home. static
local-zone: zghjccbob3n0. static
local-zone: dhcp. static
local-zone: lan. static
local-zone: localdomain. static
local-zone: ip. static
local-zone: internal. static
local-zone: openstacklocal. static
local-zone: dlink. static
local-zone: gateway. static
local-zone: corp. static
local-zone: workgroup. static
local-zone: belkin. static
local-zone: davolink. static
local-zone: domain. static
local-zone: virtualmin. static
local-zone: invalid. static
local-zone: wlan_ap. static
local-zone: dlinkrouter. static
local-zone: lan1. static
serve-expired: yes
prefetch: yes
prefetch-key: yes
rrset-roundrobin: yes
num-queries-per-thread: 2048
# outgoing-range: 32767
outgoing-range: 4096
incoming-num-tcp: 256 # >= haproxy dns backend maxconn, so DoT conns aren't rejected
outgoing-num-tcp: 100
jostle-timeout: 325 # average roundtrip time from AU (myserver) to US + a tiny bit extra
cache-min-ttl: 120
cache-max-ttl: 86400
infra-host-ttl: 3600
# cache-max-negative-ttl: 3600
val-bogus-ttl: 120
hide-identity: yes
hide-version: yes
hide-trustanchor: yes
unwanted-reply-threshold: 10000000
## Simple DNS rebinding protection
## refer to RFC1918, RFC5735, RFC5156 and https://en.wikipedia.org/wiki/Reserved_IP_addresses
## IPv4
private-address: 0.0.0.0/32 # Should not be on the Internet (only valid as source address) See https://lwn.net/Articles/791086/ still conflits with https://tools.ietf.org/html/rfc8190
private-address: 10.0.0.0/8 # Private networks
private-address: 127.0.0.0/8 # Loopback, spam-blocklists (RBL) (https://www.dnsbl.info/) e.g. "dig +short 0.0.0.0.zen.spamhaus.org" will stop working (https://www.spamhaus.org/zen/, https://www.spamhaus.org/faq/section/DNSBL%20Usage#202)
private-address: 169.254.0.0/16 # link-local (networks without DHCP)
private-address: 172.16.0.0/12 # Private networks
private-address: 192.168.0.0/16 # Private networks
private-address: 255.255.255.255/32 # Broadcast destination
## IPv6
private-address: ::/128 # Unspecified addresses (only valid as source address)
private-address: ::1/128 # Loopback
private-address: 2001:db8::/32 # Documentation addresses used for documentation purposes such as user manuals, RFCs, etc. (RFC3849)
# private-address: ::ffff:0:0/96 # IPv4-mapped IPv6 addresses (depreciated and should not be on the public internet) (blocks potentially valid addresses / gives wrong result from DNS Benchmark)
private-address: fe80::/10 # IP address autoconfiguration (link-local unicast, Private network)
private-address: fc00::/7 # Unique Local Addresses (Private network)
# private-address: fec0::/10 # Depreciated site networks
# private-address: 2002::/16 # 6to4 (deprecated)
# private-address: 64:ff9b::/96 # 6to4 "Well-Known" Prefix
# private-address: 2001::/32 # Teredo
private-address: 2001:10::/28 # ORCHID
# private-address: ff00::/8 # Multicast
## Selected IPv4 mapped addresses from IPv4 above (fixes potentially wrong result from DNS Benchmark if blocking all of ::ffff:0:0/96)
private-address: ::ffff:0.0.0.0/128 # Private IPv4-mapped addresses
private-address: ::ffff:10.0.0.0/120 # Private IPv4-mapped addresses
private-address: ::ffff:127.0.0.1/120 # Loopback IPv4-mapped addresses, spam-blocklists (RBL)
private-address: ::ffff:169.254.0.0/112 # Link-local IPv4-mapped addresses
private-address: ::ffff:172.16.0.0/116 # Private IPv4-mapped addresses
private-address: ::ffff:192.168.0.0/112 # Private IPv4-mapped addresses
private-address: ::ffff:255.255.255.255/128 # Broadcast IPv4-mapped addresses
##
do-not-query-localhost: yes # ::1 and 127.0.0.1/8
do-not-query-address: 127.0.0.0/8
# do-not-query-address: 10.0.0.0/8 # kube/docker ips, needed for nsd
# do-not-query-address: 172.16.0.0/12 # docker-compose, needed for nsd
do-not-query-address: 192.168.0.0/16
# per-domain outgoing query cap: client-IP-independent, safe for all transports
ratelimit: 1000
# ip-ratelimit is per-client: now effective for DoT (real IP via PROXYv2) and Do53,
# but DoH funnels through the m13253-doh container IP, so a low cap would throttle
# ALL DoH as one bucket. Leave off until the DoH path also forwards the client IP.
# ip-ratelimit: 50
### harden-large-queries: yes
### harden-short-bufsize: yes
## harden-algo-downgrade: yes
### harden-referral-path: yes
## prefer-ip6: yes
# delay-close: 1500
# https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https
local-zone: "use-application-dns.net." always_nxdomain
auth-zone:
name: "."
url: "https://www.internic.net/domain/root.zone"
fallback-enabled: yes
for-downstream: no
for-upstream: yes
zonefile: /run/root.zone
remote-control:
control-enable: yes
control-interface: 127.0.0.1
stub-zone:
name: "dns.opennic.glue"
stub-addr: "127.0.0.1@552" # Authorative Slave DNS server
stub-zone:
name: "bbs"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "bit"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "chan"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "cyb"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "dyn"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "epic"
stub-addr: "127.0.0.1@552"
# stub-zone:
# name: "free"
# stub-addr: "127.0.0.1@552"
stub-zone:
name: "fur"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "geek"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "gopher"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "indy"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "libre"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "neo"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "null"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "o"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "opennic.glue"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "oss"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "oz"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "parody"
stub-addr: "127.0.0.1@552"
stub-zone:
name: "pirate"
stub-addr: "127.0.0.1@552"
# OpenNIC Peers:
stub-zone:
name: "bazar"
stub-host: "seed1.emercoin.com"
stub-host: "seed2.emercoin.com"
stub-zone:
name: "coin"
stub-host: "seed1.emercoin.com"
stub-host: "seed2.emercoin.com"
stub-zone:
name: "emc"
stub-host: "seed1.emercoin.com"
stub-host: "seed2.emercoin.com"
stub-zone:
name: "lib"
stub-host: "seed1.emercoin.com"
stub-host: "seed2.emercoin.com"
stub-zone:
name: "ku"
stub-addr: "127.0.0.1@552"
stub-addr: "5.45.96.220" # ns1.new-nations.ku
stub-addr: "185.82.22.133" # ns2.new-nations.ku
stub-zone:
name: "te"
stub-addr: "127.0.0.1@552"
stub-addr: "5.45.96.220" # ns1.new-nations.te
stub-addr: "185.82.22.133" # ns2.new-nations.te
stub-zone:
name: "ti"
stub-addr: "127.0.0.1@552"
stub-addr: "5.45.96.220" # ns1.new-nations.ti
stub-addr: "185.82.22.133" # ns2.new-nations.ti
stub-zone:
name: "uu"
stub-addr: "127.0.0.1@552"
stub-addr: "5.45.96.220" # ns1.new-nations.uu
stub-addr: "185.82.22.133" # ns2.new-nations.uu
# stub-zone:
# name: "ko"
# stub-addr: "127.0.0.1@552"
# stub-addr: "5.45.96.220" # ns1.new-nations.ko
# stub-addr: "185.82.22.133" # ns2.new-nations.ko
# stub-zone:
# name: "rm"
# stub-addr: "127.0.0.1@552"
# stub-addr: "5.45.96.220" # ns1.new-nations.rm
# stub-addr: "185.82.22.133" # ns2.new-nations.rm