Unbound - Authoritative Recursive Caching DNS Server

[^Tripper^]

... "SNB standards”...

That needs to be codified!

 

[Chris0815]

From the experiences I have with VPN and unbound services, there are two options for the interaction between the two services.
The first with assigning NordVPN's IP to the outgoing-interface option, suggested by Dave14305:
The other option is a forward-zone, insert NordVPN's IP.

rgnldo, SomeWhereOverTheRainBow, dave14305 - thank you for your comments. As fas as I understood only a minority is using unbound over VPN. So I will consider if this setup is really necessary. The only advantage of this setup would be that this can potentially hide the traffic if ISP is actively starting to sniff traffic, correct? Otherwise ISP should not see it.

 

[SomeWhereOverTheRainBow]

Made no difference, ISP must be the cause.
View attachment 22340
Is there a way to run unbound with the DoT enabled, that might help to mitigate these resolver leaks. I saw in the config file that there are parameters for this. Is there an explanation on how to enable this?

Do you have
do-tcp=yes

In your .conf?

 

[SomeWhereOverTheRainBow]

rgnldo, SomeWhereOverTheRainBow, dave14305 - thank you for your comments. As fas as I understood only a minority is using unbound over VPN. So I will consider if this setup is really necessary. The only advantage of this setup would be that this can potentially hide the traffic if ISP is actively starting to sniff traffic, correct? Otherwise ISP should not see it.

Correct isp will not see traffic unless they sniff for it.

 

[Mutzli]

Do you have
do-tcp=yes

In your .conf?

yes:
do-ip4: yes
#do-ip6: no
do-udp: yes
do-tcp: yes

 

[rgnldo]

rgnldo, SomeWhereOverTheRainBow, dave14305 - thank you for your comments. As fas as I understood only a minority is using unbound over VPN. So I will consider if this setup is really necessary. The only advantage of this setup would be that this can potentially hide the traffic if ISP is actively starting to sniff traffic, correct? Otherwise ISP should not see it.

If it is useful, there are two topics on VPN and unbound.
VPN unbound
NordVPN and unbound

Due to how unbound is enabled on the FW, to cache your VPN provider, you must inform the VPN DNS in the unbound configuration file.

Without unbound, the default is to add the DNS VPN to the FW Merlin WAN. The DNS VPN will be read by the resolv.dnsmasq file by dnsmasq.

 

[Chris0815]

Thank you rgnldo!
Things getting clearer for me now.
A lot of different possibilities, depends on the aim.

Due to how unbound is enabled on the FW, to cache your VPN provider, you must inform the VPN DNS in the unbound configuration file.

Without unbound, the default is to add the DNS VPN to the FW Merlin WAN. The DNS VPN will be read by the resolv.dnsmasq file by dnsmasq.

These two options would make the VPN provider to resolve DNS and showing his IP in DNS-leak-test.
First solution with caching using unbound, but configured as a forwarder, not communicating directly with the name severs.
Second solution without unbound, only VPN DNS.
So first solution still preferable.

I was thinking about a possibility to use unbound as a recursive caching server - But for the DNS communication with the root-servers, unbound should use the configured (Nord-)VPN connection on the router. Idea was to hide from ISP. With defining the outgoing-interface it is generally working so far.

But you are right - the correct way using VPN is to use the DNS by VPN provider not to leak own IP (unbound configured as a recursive resolver would leak it).
But for general configuration I will use unbound as recursive caching server...

 

[dave14305]

I've been afraid of your scary clown avatar since the beginning.

@rgnldo has a real face!

 

[rgnldo]

@rgnldo has a real face!

Yes. I got used to other forums, whose members are identified, among other criteria, as the responsibility in the posts. Anonymity does not make sense.

 

[JGrana]

@rgnldo has a real face!

And he is smiling at that! ;-)
BTW, great job @rgnldo and @dave14305 . I installed Unbound yesterday via Amtm. Considering the complexity of this function, the installation was very easy.

 

[dave14305]

And he is smiling at that! ;-)
BTW, great job @rgnldo and @dave14305 . I installed Unbound yesterday via Amtm. Considering the complexity of this function, the installation was very easy.

That credit goes to @Martineau instead of me.

 

[rgnldo]

With UPnP disabled, in my daily use, I have streaming services, samba etc. With unbound installed, it works perfect eliminating these options (bogus-priv/domain-needed) in Dnsmasq. (I may be wrong, but I need something to work.)

Another point that I considered, I omitted the access-control options and the TTL values. If the operator of a zone decides to set extremely low or high TTLs, he/she usually has a good reason to do so. A resolver should not interfere at this point.

To my surprise, it is perfect.
So, what do you think?

 

[dave14305]

With unbound installed, it works perfect eliminating these options (bogus-priv/domain-needed) in Dnsmasq. (I may be wrong, but I need something to work.)

That would suggest that dnsmasq is forwarding unqualified hostnames and private IP addresses to Unbound to resolve, which it would have no way to resolve. Those options prevent local network names and IPs to be sent upstream, since no upstream DNS provider will know your local hostnames and private IPs. Only if you're populating Unbound with local-zone data for your home/local network would should this be considered a good idea.

bogus-priv
Bogus private reverse lookups. All reverse lookups for private IP ranges (ie 192.168.x.x, etc) which are not found in /etc-hosts or the DHCP leases file are answered with "no such domain" rather than being forwarded upstream. The set of prefixes affected is the list given in RFC6303, for IPv4 and IPv6.

domain-needed
Tells dnsmasq to never forward A or AAAA queries for plain names, without dots or domain parts, to upstream nameservers. If the name is not known from /etc-hosts or DHCP then a "not found" answer is returned.

 

[rgnldo]

That would suggest that dnsmasq is forwarding unqualified hostnames and private IP addresses to Unbound to resolve, which it would have no way to resolve. Those options prevent local network names and IPs to be sent upstream, since no upstream DNS provider will know your local hostnames and private IPs. Only if you're populating Unbound with local-zone data for your home/local network would should this be considered a good idea.

You're right. The options are correct for the operation of dnsmasq. But considering that unbound is acting as a resolver, DNSSEC inspector and DNS Rebind etc, these options may not be working. Remember the doubt of PLEX and unbound? Well, the fact is that all services that require streaming and location communication work.

 

[Ubimo]

When I'm running unbound, I cannot resolve
https://uwz.at/
https://www.zamg.ac.at/
Is it just me?
Edit:
I think the problem is somewhere else, have to investigate...

 

[rgnldo]

When I'm running unbound, I cannot resolve
https://uwz.at/
https://www.zamg.ac.at/
Is it just me?
Edit:
I think the problem is somewhere else, have to investigate...

As FW Merlin is organized, it is very simple to check if the domain resolution problem is your ISP or unbound server configuration. Logged in as SSH at FW Merlin, run:

For test ISP resolver:

dig uwz.at

For test unbound resolver:

dig -p 53535 @127.0.0.1 uwz.at

 

[Treadler]

When I'm running unbound, I cannot resolve
https://uwz.at/
https://www.zamg.ac.at/
Is it just me?
Edit:
I think the problem is somewhere else, have to investigate...

I can get to them just fine here.

 

[SomeWhereOverTheRainBow]

I can get to them just fine here.

Me too.

 

[L&LD]

Me too. The first loads over twice as fast as the second link, but they both load fine.

 

[Lord Lovaduck]

Hello! I am a noob regarding Unbound/DNS and I am curious as if using it would provide a benefit in terms of performance. I live in Patagonia, very far "down" in South America. This is the bottom of the world... specially in terms of internet service. Getting a few Mbps is a miracle here and I am trying to squeeze as much I can from the limited bandwidth I have. My router is an AC68U.
Will installing unbound provide some relief by caching DNS queries? Does the default configuration provide that or should I modify the server and interface to match my configuration.

I was looking at this post and the basic minimal configuration it presents, which is different than what is installed by AMTM's unbound installer.

...
Example 1 - minimal configuration for caching-only DNS
# unbound.conf for a local subnet.
server:
interface: 192.168.1.10
interface: FD00:2216:9203:2::4
access-control: 192.168.0.0/16 allow
access-control: ::1 allow
verbosity: 1

Or, am I using a cannon to kill a mosquito and a simpler solution would do for my minimalistic needs? Any comments appreciated!