Unbound the local DNS server
Unbound Website = https://docs.pi-hole.net/guides/dns/unbound/
Install Unbound
sudo apt install unbound
~~~~~~~~~~~~~~~~~~~~~~~~~
Configure Unbound
nano /etc/unbound/unbound.conf.d/pi-hole.conf
server:
# If no logfile is specified, syslog is used
# logfile: “/var/log/unbound/unbound.log”
verbosity: 0
interface: 127.0.0.1
port: 5335
do-ip4: yes
do-udp: yes
do-tcp: yes
# May be set to yes if you have IPv6 connectivity
do-ip6: no
# You want to leave this to no unless you have *native* IPv6. With 6to4 and
# Terredo tunnels your web browser should favor IPv4 for the same reasons
prefer-ip6: no
# Use this only when you downloaded the list of primary root servers!
# If you use the default dns-root-data package, unbound will find it automatically
#root-hints: “/var/lib/unbound/root.hints”
# Trust glue only if it is within the server’s authority
harden-glue: yes
# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes
# Don’t use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no
# Reduce EDNS reassembly buffer size.
# Suggested by the unbound man page to reduce fragmentation reassembly problems
edns-buffer-size: 1472
# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes
# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
num-threads: 1
# Ensure kernel buffer is large enough to not lose messages in traffic spikes
so-rcvbuf: 1m
# Ensure privacy of local IP ranges
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Restart Unbound
service unbound restart
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Test Unbound
dig pi-hole.net @127.0.0.1 -p 5335
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Pi-Hole Install = https://youtu.be/3IyEETMJ09g
PiVPN Install = https://youtu.be/AfCPFdWl0Xk
by LoRes DIY
linux dns server
I just come here to admire your shirt! Lets play rock n' roll
DNS leak test shows that my DNS still leak. this will not help?
Nice vid. Easy instructions. I'm now running Unbound on my Pi.
great video, simple and straightforward. Thank you
Thanks for the great Video.
I'm looking to run OpnSense on an older PC (not in a VM) as my Router/Firewall, and I'd like to run my own DNS as well. I pretty sure Pihole can be installed in OpnSense, but I can't figure out how to install Unbound. Any chance you could make a Video on that?
Hi there , with your explanation mean that we jump only local isp dns server and send our request to main DNSserver like google or opendns or quad dnd server on internet right ?
Wow late to this party. Just found this vid come across my feed.
Your ISP is going to know where you go on the net regardless.. ( you are going through their equipment after all)
The only way to keep the ISP from being nosy is to use a VPN
Thanks for the video… 2 questions.. what's unbound really for? – and, what if I want to set pihole as main dhcp server, how can I prevent users from using their own dns?
Thanks from France man, it's very easy to install pi-hole and unbound on lxc container.
I wish unbound had some sort of User Interface. I don't fully understand what's going on in my Pi-Hole now… Great video btw, subbed!
Good video.nice work