##########################
# Unbound Configuration
##########################

##
# Server configuration
##
server:

chroot: /var/unbound
username: "unbound"
directory: "/var/unbound"
pidfile: "/var/run/unbound.pid"
use-syslog: yes
port: 53
verbosity: 1
hide-identity: yes
hide-version: yes
harden-glue: yes
do-ip4: yes
do-ip6: no
do-udp: yes
do-tcp: yes
do-daemonize: yes
module-config: "iterator"
unwanted-reply-threshold: 0
num-queries-per-thread: 4096
jostle-timeout: 200
infra-keep-probing: no
infra-host-ttl: 900
infra-cache-numhosts: 10000
outgoing-num-tcp: 10
incoming-num-tcp: 10
edns-buffer-size: 1432
cache-max-ttl: 86400
cache-min-ttl: 0
harden-dnssec-stripped: yes
msg-cache-size: 4m
rrset-cache-size: 8m
qname-minimisation: yes

num-threads: 4
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
outgoing-range: 4096
so-rcvbuf: 16m

prefetch: no
prefetch-key: no
use-caps-for-id: no
serve-expired: no
sock-queue-timeout: 0
aggressive-nsec: no
# Statistics
# Unbound Statistics
statistics-interval: 0
extended-statistics: yes
statistics-cumulative: yes

# TLS Configuration
tls-cert-bundle: "/etc/ssl/cert.pem"

# Interface IP addresses to bind to
interface: 172.21.56.51
interface: 192.168.254.10
interface: 2a07:7e84:1000:19a1:8ac9:b3ff:feb6:1639
interface: 192.168.30.12
interface: 10.10.10.1
interface: ::10.10.10.1
interface: 10.14.0.1
interface: 192.168.4.1
interface: 172.21.56.11
interface: 192.168.254.11
interface: 127.0.0.1
interface: ::1


# DNS Rebinding
# For DNS Rebinding prevention
private-address: 127.0.0.0/8
private-address: 10.0.0.0/8
private-address: ::ffff:a00:0/104
private-address: 172.16.0.0/12
private-address: ::ffff:ac10:0/108
private-address: 169.254.0.0/16
private-address: ::ffff:a9fe:0/112
private-address: 192.168.0.0/16
private-address: ::ffff:c0a8:0/112
private-address: fd00::/8
private-address: fe80::/10



# Access lists
include: /var/unbound/access_lists.conf

# Static host entries
include: /var/unbound/host_entries.conf

# kea2unbound entries
include: /var/unbound/leases/*



# Domain overrides
include: /var/unbound/domainoverrides.conf
# Forwarding
forward-zone:
	name: "."
	forward-addr: 172.21.56.1
	forward-addr: 8.8.8.8
	forward-addr: 8.8.4.4


# Unbound custom options
server:
private-domain: "pfsense.org"
server:
private-domain: "netgate.com"
server:
private-domain: "mydomain.local"


###
# Remote Control Config
###
include: /var/unbound/remotecontrol.conf

