Unbound [Release] v3.22

[Make WiFi Great Again]

yea you was right. i had to edit unbound.conf, that is the smaller unbound.conf.. and make it say

tls-cert-bundle: "/tmp/mnt/Entware/entware/etc/ssl/certs/ca-certificates.crt" # v1.01 as per @dave14305

thank you dave. ive literally spend hours on this. i guess nobody else tried unbound on johns fork or this issue would have came up for someone else by now.

 

[dave14305]

thank you dave. ive literally spend hours on this. i guess nobody else tried unbound on johns fork or this issue would have came up for someone else by now.

I have.

GitHub - dave14305/Unbound-Merlin-UI: ASUSWRT-Merlin Unbound User Interface

ASUSWRT-Merlin Unbound User Interface. Contribute to dave14305/Unbound-Merlin-UI development by creating an account on GitHub.

github.com

 

[juched]

Found an issue with 3.22 today when running "dnsmasq disable".

dhcp-option=br1,6,1.1.1.1 1.0.0.1 # unbound_manager
dhcp-option=br2,6,1.1.1.1 1.0.0.1 # unbound_manager

was added to the dnsmasq.conf.add, but the syntax stopped dnsmasq from launching. Needed to replace the space with a comma and now it works.

 

[Martineau]

Found an issue with 3.22 today when running "dnsmasq disable".

dhcp-option=br1,6,1.1.1.1 1.0.0.1 # unbound_manager
dhcp-option=br2,6,1.1.1.1 1.0.0.1 # unbound_manager

was added to the dnsmasq.conf.add, but the syntax stopped dnsmasq from launching. Needed to replace the space with a comma and now it works.

I've pushed Beta unbound_manager v3.23b5

To install

e  = Exit Script [?]

A:Option ==> uf dev

    unbound_manager.sh downloaded successfully Github 'dev/development' branch

unbound Manager UPDATE Complete! 6b4a500c071bcbb3f4a6e9596a178d43

+======================================================================+
|  Welcome to the unbound Manager/Installation script (Asuswrt-Merlin) |
|                                                                      |
|                      Version 3.23b5 by Martineau                     |
|                                                                      |
+======================================================================+

To backout

e  = Exit Script [?]

A:Option ==> uf

Forced Update


    unbound_manager.sh downloaded successfully

unbound Manager UPDATE Complete! 6b4a500c071bcbb3f4a6e9596a178d43

+======================================================================+
|  Welcome to the unbound Manager/Installation script (Asuswrt-Merlin) |
|                                                                      |
|                      Version 3.22 by Martineau                       |
|                                                                      |
+======================================================================+

 

[juched]

Another item I have been playing with. I like to use the disable dnsmasq, which allows unbound to take over the full DNS for the house. However, it also means that we loose local DNS resolution (like DHCP clients). There is some code to simulate this and create a unbound.conf.localhosts, but it runs onces and generates extra output.

I have been running for months now a config where I move dnsmasq to port 9953 (instead of 0 which disables it), and then setup a forward-zone in my unbound.conf.add file to forward my "lan." domain to use dnsmasq on port 9953. This means that unbound is used for everything except local DNS, and it runs cleanly.

/jffs/addons/unbound/unbound.conf changes to insert port=9953 instead of port=0

/opt/share/unbound/config/unbound.conf.localhosts would get rid of most of what it generates and use this:

#redirect all local lan requests to dnsmasq on port 9953
local-zone: "lan." transparent
forward-zone:
name: "lan."
forward-addr: 127.0.0.1@9953
forward-first: no
forward-no-cache: yes

(of course "lan." comes from whatever is put into the router domain field)



I also added this section above that (so it is in the server section to handle local DNS services queries for mDNS items:

#deal with app devices DNS services requests
local-data: "b._dns-sd._udp.lan. 60 IN PTR lan."
local-data: "lb._dns-sd._udp.lan. 60 IN PTR lan."
local-data: "lb._dns-sd._udp.0.2.168.192.in-addr.arpa. 60 IN PTR lan."
local-data: "lb._dns-sd._udp.254.254.254.10.in-addr.arpa. 60 IN PTR lan."
local-data: "lb._dns-sd._udp.1.0.0.192.in-addr.arpa. 60 IN PTR lan."

 

[juched]

Another thought. Perhaps the script could move away from trying to force a config where everything is run through unbound. For example, the requirement during install that you have DNSFilter on for all devices to point to the router, that doesn't really seem necessary and do not use that config and just say to install anyways. Sometimes you want to run a DNS and point some devices to use it, or all others to continue to use their own. I personally use AdGuard now for filtering and reporting locally, and it simply uses unbound for all lookups. This gives a fast DNS which the power of Adguard home to configure and track all sorts of things.

Also, during the "dnsmasq disable" mode, the scripts pushes dhcp-option,6,$ROUTER_IP to the dnsmasq.conf, which isn't necessary really, since dnsmasq already points to whatever you configure in your DNS settings for LAN. If you do not put any DNS settings, it adds has that exact same line added. Perhaps we could make the script more generic by not changing the DHCP settings and users who want to use unbound would configure their devices or router how they wish to use it. The instructions are as simple as "remove all DNS settings from LAN page

Just some suggestions. I really appreciate running this sever locally, but now that I am using adguard and some other changes, am sharing these thoughts as I manually change things after a unbound.conf file update.

 

[elnash]

Hello good, could you tell me how to unbound Unbound. Thanks.

 

[francovilar]

I have been running for months now a config where I move dnsmasq to port 9953 (instead of 0 which disables it), and then setup a forward-zone in my unbound.conf.add file to forward my "lan." domain to use dnsmasq on port 9953. This means that unbound is used for everything except local DNS, and it runs cleanly.

/jffs/addons/unbound/unbound.conf changes to insert port=9953 instead of port=0

did you mean /etc/dnsmasq.conf ?

 

[juched]

did you mean /etc/dnsmasq.conf ?

No, but it was a typo. /jffs/addons/unbound/unbound.postconf

Snip:

[ -z "$(grep -F "port=9953" $CONFIG)" ] && pc_append "port=9953"
#[ -z "$(grep -F "dhcp-option=lan,6,$ROUTER"

fi else sed -i '/port=9953/d' $CONFIG #pc_delete "dhcp-option=lan,6,$ROUTER" $CONFIG fi

 

[Deleted member 62525]

Another item I have been playing with. I like to use the disable dnsmasq, which allows unbound to take over the full DNS for the house. However, it also means that we loose local DNS resolution (like DHCP clients). There is some code to simulate this and create a unbound.conf.localhosts, but it runs onces and generates extra output.

I have been running for months now a config where I move dnsmasq to port 9953 (instead of 0 which disables it), and then setup a forward-zone in my unbound.conf.add file to forward my "lan." domain to use dnsmasq on port 9953. This means that unbound is used for everything except local DNS, and it runs cleanly.

/jffs/addons/unbound/unbound.conf changes to insert port=9953 instead of port=0

/opt/share/unbound/config/unbound.conf.localhosts would get rid of most of what it generates and use this:


(of course "lan." comes from whatever is put into the router domain field)



I also added this section above that (so it is in the server section to handle local DNS services queries for mDNS items:

Local DNS resolution for your home hosts/servers is a very simple entries in unbound.conf or if you wish you can make them in a separate file or even unbound.conf.localhost. I dont think this is a deal breaker.

 

[juched]

Local DNS resolution for your home hosts/servers is a very simple entries in unbound.conf or if you wish you can make them in a separate file or even unbound.conf.localhost. I dont think this is a deal breaker.

Agree, and was doing that. However, for DHCP devices only dnsmasq has the configuration to know of those changes, so that is why i shared. But for fixed IPs, this can be done as you say for sure.

 

[Deleted member 62525]

I was always wondering why we need to have non-static clients listed in unbound.conf.localhost.
That is not necessary. BDY, with version 386.1 and 3861_2 unbound does not start automatically anymore on boot or restart. Did you find any workaround?

One thing I have noticed as you did is that unbound code does not set router IP (dnsmasq disabled) in /jffs/configs/dnsmasq.conf.add for quest network VLAN DNS settings. Mine was blank so dnsmasq was complaining on startup. Once I entered the IP it worked fine.