AdguardHome + Unbound on Pi4 Correct DNS settings

[sammyano]

Hello -
Was wondering if someone can advice on correct settings to reduce "upstream Response Time" in ADH. Below are my settings
Asus Merlin - RT-AC86U
Setting for router:
LAN > DHCP Server > DNS Server = Pi IP Address (Pi set with static IP)
Advertise router's IP in addition to user-specified DNS = no
LAN > DNS Director = Enabled > Global Redirection = Router > Client MAC Address = Pi IP > Redirection = No Redirection
WAN > Port Forwarding = On > Port 80 (HTTP) > Internal IP = Pi IP address, reason to give access to Certbot letencrypt cert for Pi
WAN > Internet > DNS Setting > DNS Server = Quady
Forward local domain queries to upstream DNS = no
Enable DNS Rebind protection = yes
Enable DNSSEC support = yes
Validate unsigned DNSSEC replies = yes
Prevent client auto DoH = yes
Note - Have Diversion installed via Entware on the router

Pi4 - 4gb RAM on SSD Flash Drive running 86bit bootworm
Installed letsencrypt using certbot
Installed unbound - and below is main part of the config file -
server:
verbosity: 1
interface: 0.0.0.0
port: 5335
access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.1 allow
access-control: 192.168.1.0/24 allow
root-hints: "/var/lib/unbound/root.hints"
Installed Adguard Home
Adguard Home settings -
DNS Settings -
Upstream Server: 127.0.0.1:5335
Parallel Request = selected
Fallback DNS - (Have used empty and Quad)
Bootraps DNS = 127.0.0.1:5335
Private reverse DNS = Router IP
Use private reverse = selected
Enable reverse resolving = selected
Enable DNSSEC = deselected
Cache size = 0
Settings > Encryption settings
Enable Encryption (HTTPS, DNS-over-HTTPS, and DNS-over-TLS) = selected
Enable plain DNS = selected
Server Name = My domain name
Certificates = used path of letsencrypt in Pi
With the above settings, is/are things I need to change to make my upstream request time to reduce, currently have the below values -
Quad - 1,355 ms
192.168.1.1 - 530ms
127.0.0.1 - 496ms
However, if I run dig @127.0.0.1 -p5335 google.com from the Pi it records under 0msec
Initial I thought it could be cause of me connecting to Wiregaurd session manager, I changed the DNS there to use my Pi, still same result, even without VPN on.
Will appreciate any input as what to change to improve speed both in ADH and my Home network on even when I use Tailscale outside of my home
thanks

 

[bbunge]

Why do you have AdGuard Home and Unbound on the RPI? One or the other but not both!
If you have Diversion on the router why do you have a Pi-Hole? They do the same thing and Diversion uses the same block lists as Pi-Hole.
Why do you have Letsencrypt on the RPI? Does it run a web server? Port forwarding port 80 to the RPI is a big security risk!
You really need to do some more research..
But for now disable port forwarding on the router
LAN > DHCP Server > DNS Server = (blank)
Advertise router's IP in addition to user-specified DNS = Yes
LAN > DNS Director = Enabled > Global Redirection = Router and disable everything else!

And wipe the RPI and start over! I've run a Pi-Hole with Stubby which gives DoT. There are instructions on the Pi-Hole Forum for this and the correct way to run Unbound. But with Diversion you do not need a Pi-Hole!

 

[Tech9]

Why do you have AdGuard Home and Unbound on the RPI? One or the other but not both!

Nothing wrong with this setup. I was running Unbound + AdGuard Home on external device + Asus router as a test setup and it was working exactly as expected with 1ms cached responses and whatever it takes time for new queries. Unbound as resolver, AdGuard Home as filter and visibility in a nice UI. If left running and undisturbed it starts working better after some time using local cache. My configuration was Unbound cache only with AdGuard Home cache disabled. My eyes are tired and can't spot the OP issue...

No idea what "Quady", Rebind, DNSSEC, Diversion, etc. are doing on this router when seems like nothing is actually used nor needed.

 

[sammyano]

Why do you have AdGuard Home and Unbound on the RPI? One or the other but not both!
If you have Diversion on the router why do you have a Pi-Hole? They do the same thing and Diversion uses the same block lists as Pi-Hole.
Why do you have Letsencrypt on the RPI? Does it run a web server? Port forwarding port 80 to the RPI is a big security risk!
You really need to do some more research..
But for now disable port forwarding on the router
LAN > DHCP Server > DNS Server = (blank)
Advertise router's IP in addition to user-specified DNS = Yes
LAN > DNS Director = Enabled > Global Redirection = Router and disable everything else!

And wipe the RPI and start over! I've run a Pi-Hole with Stubby which gives DoT. There are instructions on the Pi-Hole Forum for this and the correct way to run Unbound. But with Diversion you do not need a Pi-Hole!

There's nothing wrong with having AGH and unbound installed, why do you thing I should wipe Pi and run Pi-hole? I prefer AD=GH, for Diversion am going to uninstall it as prior to installing AGH & unbound, when using only Diversion, websites were still displaying ads, but all that stop with AGH with unbound

 

[sammyano]

Nothing wrong with this setup. I was running Unbound + AdGuard Home on external device + Asus router as a test setup and it was working exactly as expected with 1ms cached responses and whatever it takes time for new queries. Unbound as resolver, AdGuard Home as filter and visibility in a nice UI. If left running and undisturbed it starts working better after some time using local cache. My configuration was Unbound cache only with AdGuard Home cache disabled. My eyes are tired and can't spot the OP issue...

No idea what "Quady", Rebind, DNSSEC, Diversion, etc. are doing on this router when seems like nothing is actually used nor needed.

Pls can you explain more "No idea what "Quady", Rebind, DNSSEC," for Diversion am going to uninstall

 

[bbunge]

There's nothing wrong with having AGH and unbound installed, why do you thing I should wipe Pi and run Pi-hole? I prefer AD=GH, for Diversion am going to uninstall it as prior to installing AGH & unbound, when using only Diversion, websites were still displaying ads, but all that stop with AGH with unbound

Sorry, it was late and I did not see that you did not have Pi-Hole installed.
Still, having an open port 80 to the RPI is not a good idea.

 

[sammyano]

Sorry, it was late and I did not see that you did not have Pi-Hole installed.
Still, having an open port 80 to the RPI is not a good idea.

Yea, i have removed used it for certbot when installing certs for Pi - cheers