Unbound with pihole

NetwrkNoob · December 28, 2024, 5:39pm

From my understanding (which isnt much), instead of using google, cloudlfare, my isp, etc, it uses root servers for dns resolving but I dont know what those root servers are.

Would it be icann?
How do I enable it?

Since it initially works but stops if a device disconnects from the network, does that sound more like a dhcp issue?

NetwrkNoob · December 28, 2024, 11:05pm

How do i incorporate the section for Parallel dnsmasq?

github.com

openwrt/packages/blob/master/net/unbound/files/README.md

# Unbound Recursive DNS Server with UCI
<!-- markdownlint-disable -->

## Unbound Description
[Unbound](https://www.unbound.net/) is a validating, recursive, and caching DNS resolver. The C implementation of Unbound is developed and maintained by [NLnet Labs](https://www.nlnetlabs.nl/). It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modular components, so that also DNSSEC (secure DNS) validation and stub-resolvers (that do not run as a server, but are linked into an application) are easily possible.

## Package Overview
OpenWrt default build uses [dnsmasq](http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html) for DNS forwarding and DHCP. With a forward only resolver, dependence on the upstream recursors may be cause for concern. They are often provided by the ISP, and some users have switched to public DNS providers. Either way may result in problems due to performance, "snoop-vertising", hijacking (MiM), and other causes. Running a recursive resolver or resolver capable of TLS may be a solution.

Unbound may be useful on consumer grade embedded hardware. It is fully DNSSEC and TLS capable. It is _intended_ to be a recursive resolver only. NLnet Labs [NSD](https://www.nlnetlabs.nl/projects/nsd/) is _intended_ for the authoritative task. This is different than [ISC Bind](https://www.isc.org/downloads/bind/) and its inclusive functions. Unbound configuration effort and memory consumption may be easier to control. A consumer could have their own recursive resolver with 8/64 MB router, and remove potential issues from forwarding resolvers outside of their control.

This package builds on Unbounds capabilities with OpenWrt UCI. Not every Unbound option is in UCI, but rather, UCI simplifies the combination of related options. Unbounds native options are bundled and balanced within a smaller set of choices. Options include resources, DNSSEC, access control, and some TTL tweaking. The UCI also provides an escape option and works at the raw `unbound.conf` level.

## HOW TO: Ad Blocking
The UCI scripts will work with [net/adblock](https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md), if it is installed and enabled. Its all detected and integrated automatically. In brief, the adblock scripts create distinct local-zone files that are simply included in the unbound conf file during UCI generation. If you don't want this, then disable adblock or reconfigure adblock to not send these files to Unbound.

A few tweaks may be needed to enhance the realiability and effectiveness. Ad Block option for delay time may need to be set for upto one minute (adb_triggerdelay), because of boot up race conditions with interfaces calling Unbound restarts. Also many smart devices (TV, microwave, or refigerator) will also use public DNS servers either as a bypass or for certain connections in general. If you wish to force exclusive DNS to your router, then you will need a firewall rule for example:

**/etc/config/firewall**:
```

This file has been truncated. show original

If I paste those sections in, Unbound settings disappear from Luci?

anomeome · December 28, 2024, 11:10pm

From a working parallel setup:

/etc/config/unbound

config unbound
	option add_extra_dns '0'
	option add_local_fqdn '0'
	option add_wan_fqdn '0'
#	option dhcp_link 'none'
	option dhcp_link 'dnsmasq'
	option dhcp4_slaac6 '0'
	option dns64 '0'
	option dns64_prefix '64:ff9b::/96'
	option domain 'bsa.net'
#	option domain_type 'static'
	option domain_type 'refuse'
	option edns_size '1280'
	option extended_stats '0'
	option hide_binddata '1'
	option interface_auto '1'
#	option listen_port '5353'
	option listen_port '53'
	option localservice '1'
	option manual_conf '0'
	option num_threads '2'
	option protocol 'default'
	option query_minimize '0'
	option query_min_strict '0'
	option rebind_localhost '0'
	option rebind_protection '1'
	option recursion 'default'
	option resource 'default'
	option root_age '9'
	option ttl_min '120'
	option unbound_control '0'
	option validator '1'
	option validator_ntp '1'
	option verbosity '1'
	list trigger_interface 'lan'
	list trigger_interface 'wan'
	list domain_insecure 'bsa.net'

config zone
	option enabled '0'
	option fallback '1'
	option url_dir 'https://www.internic.net/domain/'
	option zone_type 'auth_zone'
	list server 'lax.xfr.dns.icann.org'
	list server 'iad.xfr.dns.icann.org'
	list zone_name '.'
	list zone_name 'arpa.'
	list zone_name 'in-addr.arpa.'
	list zone_name 'ip6.arpa.'

#config zone
#	option enabled '1'
#	option zone_type 'forward_zone'
#	option fallback '1'
#	option resolv_conf '0'
#	option tls_index 'dns.quad9.net'
#	option tls_port '853'
#	option tls_upstream '1'
#	list server '9.9.9.9'
#	list server '2620:fe::fe'
#	list server '149.112.112.112'
#	list server '2620:fe::9'
#	list zone_name '.'

#config zone
#	option enabled '1'
#	option zone_type 'forward_zone'
#	option fallback '1'
#	option resolv_conf '0'
#	option tls_index 'google-public-dns-a.google.com'
#	option tls_port '853'
#	option tls_upstream '1'
#	list server '8.8.8.8'
#	list server '2001:4860:4860::8888'
#	list server '8.8.8.8@853#dns.google'
#	list server '2001:4860:4860::8888@853#dns.google'
#	list zone_name '.'

#config zone
#	option enabled '1'
#	option zone_type 'forward_zone'
#	option fallback '1'
#	option resolv_conf '0'
#	option tls_index 'cloudflare-dns.com'
#	option tls_port '853'
#	option tls_upstream '1'
#	list server '2606:4700:4700::1111'
#	list server '1.1.1.1'
#	list server '2606:4700:4700::1001'
#	list server '1.0.0.1'
#	list server '1.1.1.1@853#cloudflare-dns.com'
#	list server '2606:4700:4700::1111@853#cloudflare-dns.com'
#	list zone_name '.'

#config zone
#	option enabled '0'
#	option zone_type 'forward_zone'
#	option fallback '1'
#	option resolv_conf '0'
#	option tls_upstream '1'
#	list server '9.9.9.9@853#dns.quad9.net'
#	list server '2620:fe::fe@853#dns.quad9.net'
#	list server '149.112.112.112@853#dns.quad9.net'
#	list server '2620:fe::9@853#dns.quad9.net'
#	list zone_name '.'

#config zone
#	option enabled '1'
#	option zone_type 'forward_zone'
#	option fallback '0'
#	option resolv_conf '0'
#	option tls_upstream '1'
#	list server '1.1.1.2@853#security.cloudflare-dns.com'
#	list server '2606:4700:4700::1112@853#security.cloudflare-dns.com'
#	list server '9.9.9.9@853#dns.quad9.net'
#	list server '2620:fe::9@853#dns.quad9.net'
#	list zone_name '.'

config zone
	option enabled '1'
	option zone_type 'forward_zone'
	option fallback '0'
	option resolv_conf '0'
	option tls_upstream '1'
	list server '1.1.1.1@853#one.one.one.one'
	list server '2606:4700:4700::1111@853#one.one.one.one'
	list server '8.8.8.8@853#dns.google'
	list server '2001:4860:4860::8888@853#dns.google'
	list server '9.9.9.10@853#dns10.quad9.net'
	list server '2620:fe::10@853#dns10.quad9.net'
	list zone_name '.'

NetwrkNoob · December 28, 2024, 11:15pm

Thanks!

I am a complete novice so please advise exactly the steps I need to take.
I assume first install unbound is step one.
What do I do next?

NetwrkNoob · December 29, 2024, 3:27pm

By using the below guide, I was able to get unbound installed on my Pihole and working with adblocking.

https://docs.pi-hole.net/guides/dns/unbound/

system · January 8, 2025, 3:27pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.