|
##########################
|
|
# Unbound Configuration
|
|
##########################
|
|
|
|
##
|
|
# Server configuration
|
|
##
|
|
server:
|
|
|
|
chroot: /var/unbound
|
|
username: "unbound"
|
|
directory: "/var/unbound"
|
|
pidfile: "/var/run/unbound.pid"
|
|
use-syslog: yes
|
|
port: 53
|
|
verbosity: 5
|
|
hide-identity: yes
|
|
hide-version: yes
|
|
harden-glue: yes
|
|
do-ip4: yes
|
|
do-ip6: yes
|
|
do-udp: yes
|
|
do-tcp: yes
|
|
do-daemonize: yes
|
|
module-config: "validator iterator"
|
|
unwanted-reply-threshold: 0
|
|
num-queries-per-thread: 512
|
|
jostle-timeout: 200
|
|
infra-host-ttl: 900
|
|
infra-cache-numhosts: 10000
|
|
outgoing-num-tcp: 10
|
|
incoming-num-tcp: 10
|
|
edns-buffer-size: 4096
|
|
cache-max-ttl: 86400
|
|
cache-min-ttl: 0
|
|
harden-dnssec-stripped: yes
|
|
msg-cache-size: 4m
|
|
rrset-cache-size: 8m
|
|
|
|
num-threads: 4
|
|
msg-cache-slabs: 4
|
|
rrset-cache-slabs: 4
|
|
infra-cache-slabs: 4
|
|
key-cache-slabs: 4
|
|
outgoing-range: 4096
|
|
#so-rcvbuf: 4m
|
|
auto-trust-anchor-file: /var/unbound/root.key
|
|
prefetch: no
|
|
prefetch-key: no
|
|
use-caps-for-id: no
|
|
serve-expired: no
|
|
# Statistics
|
|
# Unbound Statistics
|
|
statistics-interval: 0
|
|
extended-statistics: yes
|
|
statistics-cumulative: yes
|
|
|
|
# TLS Configuration
|
|
tls-cert-bundle: "/etc/ssl/cert.pem"
|
|
|
|
# Interface IP(s) to bind to
|
|
interface: 10.90.90.1
|
|
interface: 192.168.1.1
|
|
interface: 127.0.0.1
|
|
interface: ::1
|
|
|
|
# Outgoing interfaces to be used
|
|
outgoing-interface: 10.90.90.1
|
|
|
|
# DNS Rebinding
|
|
# For DNS Rebinding prevention
|
|
private-address: 10.0.0.0/8
|
|
private-address: ::ffff:a00:0/104
|
|
private-address: 172.16.0.0/12
|
|
private-address: ::ffff:ac10:0/108
|
|
private-address: 169.254.0.0/16
|
|
private-address: ::ffff:a9fe:0/112
|
|
private-address: 192.168.0.0/16
|
|
private-address: ::ffff:c0a8:0/112
|
|
private-address: fd00::/8
|
|
private-address: fe80::/10
|
|
# Set private domains in case authoritative name server returns a Private IP address
|
|
private-domain: "domain1.local."
|
|
domain-insecure: "domain1.local."
|
|
private-domain: "domain2.local"
|
|
domain-insecure: "domain2.local"
|
|
|
|
|
|
# Access lists
|
|
include: /var/unbound/access_lists.conf
|
|
|
|
# Static host entries
|
|
include: /var/unbound/host_entries.conf
|
|
|
|
# dhcp lease entries
|
|
include: /var/unbound/dhcpleases_entries.conf
|
|
|
|
|
|
|
|
# Domain overrides
|
|
include: /var/unbound/domainoverrides.conf
|
|
|
|
|
|
|
|
|
|
###
|
|
# Remote Control Config
|
|
###
|
|
include: /var/unbound/remotecontrol.conf
|
