What's new

Unbound - Authoritative Recursive Caching DNS Server

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Status
Not open for further replies.
From the experiences I have with VPN and unbound services, there are two options for the interaction between the two services.
The first with assigning NordVPN's IP to the outgoing-interface option, suggested by Dave14305:
The other option is a forward-zone, insert NordVPN's IP.

rgnldo, SomeWhereOverTheRainBow, dave14305 - thank you for your comments. As fas as I understood only a minority is using unbound over VPN. So I will consider if this setup is really necessary. The only advantage of this setup would be that this can potentially hide the traffic if ISP is actively starting to sniff traffic, correct? Otherwise ISP should not see it.
 
rgnldo, SomeWhereOverTheRainBow, dave14305 - thank you for your comments. As fas as I understood only a minority is using unbound over VPN. So I will consider if this setup is really necessary. The only advantage of this setup would be that this can potentially hide the traffic if ISP is actively starting to sniff traffic, correct? Otherwise ISP should not see it.

Correct isp will not see traffic unless they sniff for it.
 
rgnldo, SomeWhereOverTheRainBow, dave14305 - thank you for your comments. As fas as I understood only a minority is using unbound over VPN. So I will consider if this setup is really necessary. The only advantage of this setup would be that this can potentially hide the traffic if ISP is actively starting to sniff traffic, correct? Otherwise ISP should not see it.
If it is useful, there are two topics on VPN and unbound.
VPN unbound
NordVPN and unbound

Due to how unbound is enabled on the FW, to cache your VPN provider, you must inform the VPN DNS in the unbound configuration file.

Without unbound, the default is to add the DNS VPN to the FW Merlin WAN. The DNS VPN will be read by the resolv.dnsmasq file by dnsmasq.
 
Thank you rgnldo!
Things getting clearer for me now.
A lot of different possibilities, depends on the aim.

Due to how unbound is enabled on the FW, to cache your VPN provider, you must inform the VPN DNS in the unbound configuration file.

Without unbound, the default is to add the DNS VPN to the FW Merlin WAN. The DNS VPN will be read by the resolv.dnsmasq file by dnsmasq.

These two options would make the VPN provider to resolve DNS and showing his IP in DNS-leak-test.
First solution with caching using unbound, but configured as a forwarder, not communicating directly with the name severs.
Second solution without unbound, only VPN DNS.
So first solution still preferable.

I was thinking about a possibility to use unbound as a recursive caching server - But for the DNS communication with the root-servers, unbound should use the configured (Nord-)VPN connection on the router. Idea was to hide from ISP. With defining the outgoing-interface it is generally working so far.

But you are right - the correct way using VPN is to use the DNS by VPN provider not to leak own IP (unbound configured as a recursive resolver would leak it).
But for general configuration I will use unbound as recursive caching server...
 
With UPnP disabled, in my daily use, I have streaming services, samba etc. With unbound installed, it works perfect eliminating these options (bogus-priv/domain-needed) in Dnsmasq. (I may be wrong, but I need something to work.)

Another point that I considered, I omitted the access-control options and the TTL values. If the operator of a zone decides to set extremely low or high TTLs, he/she usually has a good reason to do so. A resolver should not interfere at this point.

To my surprise, it is perfect.
So, what do you think?
 
With unbound installed, it works perfect eliminating these options (bogus-priv/domain-needed) in Dnsmasq. (I may be wrong, but I need something to work.)
That would suggest that dnsmasq is forwarding unqualified hostnames and private IP addresses to Unbound to resolve, which it would have no way to resolve. Those options prevent local network names and IPs to be sent upstream, since no upstream DNS provider will know your local hostnames and private IPs. Only if you're populating Unbound with local-zone data for your home/local network would should this be considered a good idea.
bogus-priv
Bogus private reverse lookups. All reverse lookups for private IP ranges (ie 192.168.x.x, etc) which are not found in /etc-hosts or the DHCP leases file are answered with "no such domain" rather than being forwarded upstream. The set of prefixes affected is the list given in RFC6303, for IPv4 and IPv6.

domain-needed
Tells dnsmasq to never forward A or AAAA queries for plain names, without dots or domain parts, to upstream nameservers. If the name is not known from /etc-hosts or DHCP then a "not found" answer is returned.
 
That would suggest that dnsmasq is forwarding unqualified hostnames and private IP addresses to Unbound to resolve, which it would have no way to resolve. Those options prevent local network names and IPs to be sent upstream, since no upstream DNS provider will know your local hostnames and private IPs. Only if you're populating Unbound with local-zone data for your home/local network would should this be considered a good idea.
You're right. The options are correct for the operation of dnsmasq. But considering that unbound is acting as a resolver, DNSSEC inspector and DNS Rebind etc, these options may not be working. Remember the doubt of PLEX and unbound? Well, the fact is that all services that require streaming and location communication work.
 
When I'm running unbound, I cannot resolve
https://uwz.at/
https://www.zamg.ac.at/
Is it just me?
Edit:
I think the problem is somewhere else, have to investigate...
As FW Merlin is organized, it is very simple to check if the domain resolution problem is your ISP or unbound server configuration. Logged in as SSH at FW Merlin, run:

For test ISP resolver:
Code:
dig uwz.at
For test unbound resolver:
Code:
dig -p 53535 @127.0.0.1 uwz.at
 
Me too. The first loads over twice as fast as the second link, but they both load fine.
 
Hello! I am a noob regarding Unbound/DNS and I am curious as if using it would provide a benefit in terms of performance. I live in Patagonia, very far "down" in South America. This is the bottom of the world... specially in terms of internet service. Getting a few Mbps is a miracle here and I am trying to squeeze as much I can from the limited bandwidth I have. My router is an AC68U.
Will installing unbound provide some relief by caching DNS queries? Does the default configuration provide that or should I modify the server and interface to match my configuration.

I was looking at this post and the basic minimal configuration it presents, which is different than what is installed by AMTM's unbound installer.

...
Example 1 - minimal configuration for caching-only DNS
# unbound.conf for a local subnet.
server:
interface: 192.168.1.10
interface: FD00:2216:9203:2::4
access-control: 192.168.0.0/16 allow
access-control: ::1 allow
verbosity: 1

Or, am I using a cannon to kill a mosquito and a simpler solution would do for my minimalistic needs? Any comments appreciated!
 
Status
Not open for further replies.

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top