Skip to content

Commit fbf3499

Browse files
sohag1192sohag1192
authored
Update README.md
1 parent 6e48352 commit fbf3499

File tree

1 file changed

+156
-70
lines changed

1 file changed

+156
-70
lines changed

‎README.md‎

Lines changed: 156 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,77 +1,163 @@
1-
How to Setup DNS Server with BIND on Ubuntu 22.04
1+
# How to Set Up a Local DNS Resolver with Unbound on Debian & Ubuntu
22

3-
Show ip
4-
==================
5-
ip a
6-
7-
Set hostname
8-
======================
9-
nano /etc/hostname
10-
nano /etc/hosts
3+
Install Required Package Updates
4+
====================================
5+
sudo apt update
116

12-
Install Required package
7+
Install Required Package
138
====================================
14-
apt install -y bind9*
9+
sudo apt install unbound
10+
11+
12+
### Once Unbound is installed, run the below systemctl command to verify the Unbound service and ensure that the service is enabled and running.
13+
sudo systemctl is-enabled unbound
14+
sudo systemctl status unbound
15+
16+
# Configuring Unbound DNS Server ( Adding the Config File )
17+
18+
sudo nano /etc/unbound/unbound.conf
19+
20+
21+
22+
Copy This Text And This and editing the ip address
23+
24+
# Unbound configuration file for Debian.
25+
#
26+
# See the unbound.conf(5) man page.
27+
#
28+
# See /usr/share/doc/unbound/examples/unbound.conf for a commented
29+
# reference config file.
30+
#
31+
# The following line includes additional configuration files from the
32+
# /etc/unbound/unbound.conf.d directory.
33+
include-toplevel: "/etc/unbound/unbound.conf.d/*.conf"
34+
35+
#Adding DNS-Over-TLS support
36+
37+
server:
38+
use-syslog: yes
39+
username: "unbound"
40+
directory: "/etc/unbound"
41+
tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
42+
43+
do-ip6: no
44+
interface: 100.100.100.37
45+
port: 53
46+
prefetch: yes
47+
48+
root-hints: /usr/share/dns/root.hints
49+
harden-dnssec-stripped: yes
50+
51+
cache-max-ttl: 14400
52+
cache-min-ttl: 1200
53+
54+
aggressive-nsec: yes
55+
hide-identity: yes
56+
hide-version: yes
57+
use-caps-for-id: yes
58+
59+
60+
#control which clients are allowed to make (recursive) queries
61+
#access-control: 0.0.0.0/0 refuse
62+
#access-control: 0.0.0.0/0 allow
63+
access-control: 10.0.0.0/8 allow
64+
access-control: 50.50.50.0/24 allow
65+
access-control: 192.168.0.0/16 allow
66+
access-control: 172.16.0.0/12 allow
67+
access-control: 103.135.132.0/23 allow
68+
69+
# local zone
70+
local-zone: "sohag.lan." static
71+
local-data: "ns.sohag.lan. IN A 100.100.100.37"
72+
local-data-ptr: "100.100.100.37 ns.sohag.lan"
73+
74+
num-threads: 4
75+
msg-cache-slabs: 8
76+
rrset-cache-slabs: 8
77+
infra-cache-slabs: 8
78+
key-cache-slabs: 8
79+
rrset-cache-size: 256m
80+
msg-cache-size: 128m
81+
so-rcvbuf: 8m
82+
83+
84+
85+
forward-zone:
86+
name: "."
87+
forward-ssl-upstream: yes
88+
## Also add IBM IPv6 Quad9 over TLS
89+
forward-addr: 9.9.9.9@853#dns.quad9.net
90+
forward-addr: 149.112.112.112@853#dns.quad9.net
91+
92+
# Google
93+
forward-addr: 8.8.8.8@853
94+
forward-addr: 4.4.4.4@853
95+
96+
97+
## Next, run the systemctl command below to restart the Unbound service and apply the changes.
98+
99+
sudo systemctl restart unbound
100+
101+
102+
103+
# Unbound Log via Rsyslog and Logrotate
104+
105+
Create a new Rsyslog config file '/etc/rsyslog.d/unbound.conf' using the below nano editor command.
106+
107+
sudo nano /etc/rsyslog.d/unbound.conf
108+
109+
Add the following lines to the file. With this, Unbound logs will be stored at '/var/log/unbound.log'.
110+
111+
# Log messages generated by unbound application
112+
if $programname == 'unbound' then /var/log/unbound.log
113+
# stop processing it further
114+
& stop
115+
116+
Save the file and exit the editor when finished.
117+
118+
----
119+
120+
Now run the below systemctl command utility to restart the 'rsyslog' service and apply the changes.
121+
122+
sudo systemctl restart rsyslog
123+
124+
125+
Next, you will set up log rotation for the Unbound log file '/var/log/unbound.log'. And you can achieve this via the logrotate service.
126+
127+
-----
128+
129+
Create a new logrotate config file '/etc/logrotate.d/unbound' using the below nano editor command.
130+
131+
sudo nano /etc/logrotate.d/unbound
132+
133+
134+
Add the following lines to the file. This will create log rotation for the Unbound log file '/var/log/unbound.log' on a daily basis.
135+
136+
/var/log/unbound.log {
137+
daily
138+
rotate 7
139+
missingok
140+
create 0640 root adm
141+
postrotate
142+
/usr/lib/rsyslog/rsyslog-rotate
143+
endscript
144+
}
145+
146+
147+
Save the file and exit the editor when finished.
148+
149+
------
150+
151+
Now run the below systemctl command utility to restart the logrotate service and apply the changes.
152+
153+
sudo systemctl restart logrotate
154+
155+
156+
With this, you've now successfully installed and configured Unbound DNS server and configured logging via Rsyslog and Logrotate. Unbound logs will be saved to the file '/var/unbound/unbound.log'.
15157

16-
Change directory
17-
==========================
18-
cd /etc/bind/
19158

20-
Setting up bind9
21-
=============================
22-
nano named.conf.options
23159

24-
forwarders {
25-
8.8.8.8;
26-
1.1.1.1;
27-
};
28160

29-
listen-on { any; };
30-
allow-query { any; };
31-
allow-query-cache { any; };
32-
33-
Configure zone
34-
========================
35-
nano named.conf.local
36-
37-
zone "ripon.com" IN {
38-
type master;
39-
file "/etc/bind/forward.zone";
40-
};
41-
42-
zone "50.20.172.in-addr.arpa" IN {
43-
type master;
44-
file "/etc/bind/reverse.zone";
45-
allow-query { any; };
46-
};
47-
48-
Forward zone configuration
49-
========================================
50-
cp db.local forward.zone
51-
nano forward.zone
52-
53-
Reverse zone configuration
54-
========================================
55-
cp forward.zone reverse.zone
56-
nano reverse.zone
57-
58-
Check zones
59-
=====================
60-
named-checkzone forward.zone /etc/bind/forward.zone
61-
named-checkzone reverse.zone /etc/bind/reverse.zone
62-
63-
Set permission
64-
========================
65-
chown bind:bind /etc/bind/
66-
67-
Restart the services
68-
==================================
69-
systemctl restart bind9
70-
71-
Show services status
72-
=================================
73-
systemctl status bind9
74-
75-
Start services at boot
76-
===================================
77-
systemctl enable bind9
161+
162+
163+

0 commit comments

Comments
 (0)