Replacing DNSMasq DNS with Unbound

[XIII]

Hm, apparently the example is incorrect, but even after putting lines in the correct sections I'm not sure it works...

 

[Xentrk]

I worked on Unbound a little earlier this week. I was able to get unbound running.

My objective is to route DNS thru the VPN tunnels as I do on my pfSense appliance. And have it work in conjunction with dnsmasq as is done in these two blog posts.

http://blog.alanporter.com/2014-03-09/dnsmasq-unbound/
https://blog.josefsson.org/2015/10/26/combining-dnsmasq-and-unbound/

AB-Solution requires dnsmasq and I need the ipset functionality built into dnsmasq for other requirements.

These are the lines in my pfSense Unbound config that I think is responsible for routing the DNS queries thru the VPN tunnel.

# Outgoing interfaces to be used
outgoing-interface: 10.22.0.6
outgoing-interface: 10.9.0.6
outgoing-interface: 10.24.0.6

But when I do an ipleak.net test, I get the DNS from the WAN page. DNS is handled differently when using Policy Rules on Asuswrt-Merlin which may be a factor preventing it from working.

@kvic appears to have all the bells and whistles working as seen here.

I plan to research the topic more next week.

 

[kvic]

People in this thread use Unbound as a forwarder (just like dnsmasq). My Unbound setup is rather simple. I use it as a resolver.

Hence, I won't be able to comment e.g. forwarding over DoT. I don't intend to try either. Perhaps need to wait for @Xentrk sharing his adventure.

As a resolver, Unbound works great for me! I like it very much.

@XIII I compiled 1.7.3 myself.

 

[underdose]

People in this thread use Unbound as a forwarder (just like dnsmasq). My Unbound setup is rather simple. I use it as a resolver.

Hence, I won't be able to comment e.g. forwarding over DoT. I don't intend to try either. Perhaps need to wait for @Xentrk sharing his adventure.

As a resolver, Unbound works great for me! I like it very much.

@XIII I compiled 1.7.3 myself.

I've managed to get Unbound up and running as forwarder thanks to you. My problem is, Unbound version on Entware-ng repo is 1.6.7 and has too many critical bugs. Can you compile 1.7.3 for RT-N66U and share the package with me if that's ok for you?

 

[Xentrk]

I've managed to get Unbound up and running as forwarder thanks to you. My problem is, Unbound version on Entware-ng repo is 1.6.7 and has too many critical bugs. Can you compile 1.7.3 for RT-N66U and share the package with me if that's ok for you?

See if this works. See the source site here...

https://nlnetlabs.nl/projects/unbound/download/#unbound-1-7-3

Then, run this command.

wget https://nlnetlabs.nl/downloads/unbound/unbound-1.7.3.tar.gz
tar -zxvf unbound-1.7.3.tar.gz

Perhaps unlacke the tar file to the /opt/use/etc directory?

 

[WRobertE]

Get a Raspberry Pi and then use this:
https://pi-hole.net/

Scroll to the bottom of the linked page and read about installing Unbound on the Pi. I've been using this for a while and it works very well.

---------------
RT-AC68U Merlin 384.5 (waiting on 384.7)

 

[XIII]

See if this works.

That’s only the source; no binaries.

 

[johnathonm]

See if this works. See the source site here...

https://nlnetlabs.nl/projects/unbound/download/#unbound-1-7-3

Then, run this command.

wget https://nlnetlabs.nl/downloads/unbound/unbound-1.7.3.tar.gz
tar -zxvf unbound-1.7.3.tar.gz

Perhaps unlacke the tar file to the /opt/use/etc directory?

Guys,

What IDE are you using to build these apps? I want to learn to start compiling apps. Would you be willing to give me a little direction?

 

[kvic]

I've managed to get Unbound up and running as forwarder thanks to you. My problem is, Unbound version on Entware-ng repo is 1.6.7 and has too many critical bugs. Can you compile 1.7.3 for RT-N66U and share the package with me if that's ok for you?

There must be a reason for mipsel not in sync with other platforms on the version number. The answer could be pre-requites not fulfilling newer Unbound versions. That indicates beyond 1.6.7 not compilable on mipsel platforms.

 

[kvic]

Guys,

What IDE are you using to build these apps? I want to learn to start compiling apps. Would you be willing to give me a little direction?

The Entware build environment is inherited from OpenWRT. Mostly command lines and script driven work using standard GNU tools such as make/autotools/libtools/etc.

Entware's Github has a concise wiki on building from source. That assumes you have certain prior experience with the above tools. OpenWRT has more details wiki's but certainly not for first timers.

If you want to try, follow Entware's wiki. At least that can get you quickly started and build something. But be warned that without prior experience with the above tools, troubleshooting build errors is going to be very painful and frustrating..

 

[underdose]

There must be a reason for mipsel not in sync with other platforms on the version number. The answer could be pre-requites not fulfilling newer Unbound versions. That indicates beyond 1.6.7 not compilable on mipsel platforms.

The reason for the lower version number is: Entware-ng repo (for MIPS based routers) is not maintained anymore, the last update of the packages on the repo is dated back to March IIRC. But I'd like to give 1.7.3 a go as you did by compiling yourself and it doesn't matter if it breaks/doesn't work with my router since I can roll back the firmware and start from scratch.

Also, I'm sure I've seen unbound 1.7.3 for mipselsf on their SVN a few weeks back but now can't find it because they've redesigned the website and the SVN, probably removed platform specific packages from SVN too and made a unified one.

I've tried to compile Asuswrt-Merlin and create an Unbound installer for my RT-N66U under Ubuntu 12.04 (VM) with toolchains and dependencies installed but seems like I'm really a noob when it comes to editing/using Makefile for my liking and compiling stuff, so I need someone to compile Unbound 1.7.3 for my router or write a complete step by step, noob-proof walkthrough for me.

Thanks everyone for the replies though.

 

[Xentrk]

This is another DNS solution of interest I want to look into some more.

Using DNS-over-TLS with the Quad9 DNS Service
Stubby

 

[john9527]

This is another DNS solution of interest I want to look into some more.

Using DNS-over-TLS with the Quad9 DNS Service
Stubby

Check the post I just made in my fork thread Stubby....

 

[johnathonm]

The Entware build environment is inherited from OpenWRT. Mostly command lines and script driven work using standard GNU tools such as make/autotools/libtools/etc.

Entware's Github has a concise wiki on building from source. That assumes you have certain prior experience with the above tools. OpenWRT has more details wiki's but certainly not for first timers.

If you want to try, follow Entware's wiki. At least that can get you quickly started and build something. But be warned that without prior experience with the above tools, troubleshooting build errors is going to be very painful and frustrating..

I will have to check it out now. Thanks for the tip.

 

[XIII]

Using DNS-over-TLS with the Quad9 DNS Service

This link seems broken...

 

[Grisu]

This link seems broken...

maybe he meant this: https://github.com/jedisct1/dnscrypt-proxy/issues/68
or: https://medium.com/nlnetlabs/privacy-using-dns-over-tls-with-the-new-quad9-dns-service-1ff2d2b687c5

 

[kvic]

Stubby is available on Entware

If people want to try,

opkg install stubby

Personally I would stay with Unbound

 

[Xentrk]

This link seems broken...

Sorry, I fixed in the OP

 

[HowIFix]

Google and Quad9, they log.

Source:

• Google DNS - Your Privacy - What we log
• Quad9 DNS - My Privacy? - What does Quad9 log/store about the DNS queries?

 

[johnathonm]

I believe in you guys... Unbound will bring us into the early 2000's!