|
| 1 | +# Unbound configuration file for Debian. |
| 2 | +# |
| 3 | +# See the unbound.conf(5) man page. |
| 4 | +# |
| 5 | +# See /usr/share/doc/unbound/examples/unbound.conf for a commented |
| 6 | +# reference config file. |
| 7 | +# |
| 8 | +# The following line includes additional configuration files from the |
| 9 | +# /etc/unbound/unbound.conf.d directory. |
| 10 | +include-toplevel: "/etc/unbound/unbound.conf.d/*.conf" |
| 11 | + |
| 12 | + |
| 13 | +#Adding DNS-Over-TLS support |
| 14 | +server: |
| 15 | + use-syslog: yes |
| 16 | + username: "unbound" |
| 17 | + directory: "/etc/unbound" |
| 18 | + tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt |
| 19 | + |
| 20 | + do-ip6: no |
| 21 | + interface: 100.100.100.37 |
| 22 | + port: 53 |
| 23 | + prefetch: yes |
| 24 | + |
| 25 | + root-hints: /usr/share/dns/root.hints |
| 26 | + harden-dnssec-stripped: yes |
| 27 | + |
| 28 | + cache-max-ttl: 14400 |
| 29 | + cache-min-ttl: 1200 |
| 30 | + |
| 31 | + aggressive-nsec: yes |
| 32 | + hide-identity: yes |
| 33 | + hide-version: yes |
| 34 | + use-caps-for-id: yes |
| 35 | + |
| 36 | + |
| 37 | +#control which clients are allowed to make (recursive) queries |
| 38 | + #access-control: 0.0.0.0/0 refuse |
| 39 | + #access-control: 0.0.0.0/0 allow |
| 40 | + access-control: 10.0.0.0/8 allow |
| 41 | + access-control: 50.50.50.0/24 allow |
| 42 | + access-control: 192.168.0.0/16 allow |
| 43 | + access-control: 172.16.0.0/12 allow |
| 44 | + access-control: 103.135.132.0/23 allow |
| 45 | + |
| 46 | + |
| 47 | +# local zone |
| 48 | + local-zone: "sarkernet.lan." static |
| 49 | + local-data: "ns.sarkernet.lan. IN A 100.100.100.37" |
| 50 | + local-data-ptr: "100.100.100.37 ns.sarkernet.lan" |
| 51 | + |
| 52 | + num-threads: 4 |
| 53 | + msg-cache-slabs: 8 |
| 54 | + rrset-cache-slabs: 8 |
| 55 | + infra-cache-slabs: 8 |
| 56 | + key-cache-slabs: 8 |
| 57 | + rrset-cache-size: 256m |
| 58 | + msg-cache-size: 128m |
| 59 | + so-rcvbuf: 8m |
| 60 | + |
| 61 | +forward-zone: |
| 62 | + name: "." |
| 63 | + forward-ssl-upstream: yes |
| 64 | + ## Also add IBM IPv6 Quad9 over TLS |
| 65 | + forward-addr: 9.9.9.9@853#dns.quad9.net |
| 66 | + forward-addr: 149.112.112.112@853#dns.quad9.net |
| 67 | + |
| 68 | + # Google |
| 69 | + forward-addr: 8.8.8.8@853 |
| 70 | + forward-addr: 4.4.4.4@853 |
0 commit comments