projects / ipfire-2.x.git / blame
| Commit | Line | Data |
|---|---|---|
| d0e5f71f ML |
1 | # |
| 2 | # Unbound configuration file for IPFire | |
| 3 | # | |
| 4 | # The full documentation is available at: | |
| e737776d | 5 | # https://nlnetlabs.nl/documentation/unbound/unbound.conf/ |
| d0e5f71f ML |
6 | # |
| 7 | ||
| 8 | server: | |
| b8f5eda8 MT |
9 | # Common Server Options |
| 10 | chroot: "" | |
| 11 | directory: "/etc/unbound" | |
| 12 | username: "nobody" | |
| d0e5f71f | 13 | do-ip6: no |
| d0e5f71f | 14 | |
| b658a451 MT |
15 | # System Tuning |
| 16 | include: "/etc/unbound/tuning.conf" | |
| 17 | ||
| b8f5eda8 | 18 | # Logging Options |
| b8f5eda8 | 19 | use-syslog: yes |
| d0e5f71f ML |
20 | log-time-ascii: yes |
| 21 | ||
| 22 | # Unbound Statistics | |
| 2e0660f9 | 23 | statistics-interval: 86400 |
| d0e5f71f ML |
24 | extended-statistics: yes |
| 25 | ||
| b658a451 | 26 | # Prefetching |
| b8f5eda8 MT |
27 | prefetch: yes |
| 28 | prefetch-key: yes | |
| 29 | ||
| b8f5eda8 | 30 | # Privacy Options |
| d0e5f71f ML |
31 | hide-identity: yes |
| 32 | hide-version: yes | |
| d0e5f71f | 33 | |
| b8f5eda8 MT |
34 | # DNSSEC |
| 35 | auto-trust-anchor-file: "/var/lib/unbound/root.key" | |
| b8f5eda8 | 36 | val-log-level: 1 |
| e737776d | 37 | log-servfail: yes |
| b8f5eda8 MT |
38 | |
| 39 | # Hardening Options | |
| d0e5f71f | 40 | harden-large-queries: yes |
| b8f5eda8 | 41 | harden-referral-path: yes |
| d0e5f71f | 42 | |
| ffc46751 MT |
43 | # TLS |
| 44 | tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt | |
| 45 | ||
| ffba3c98 PM |
46 | # Harden against DNS cache poisoning |
| 47 | unwanted-reply-threshold: 1000000 | |
| 48 | ||
| 1b4d5ad9 | 49 | # Listen on all interfaces |
| d4af85f2 | 50 | interface-automatic: yes |
| 1b4d5ad9 MT |
51 | interface: 0.0.0.0 |
| 52 | ||
| 3ddad158 MT |
53 | # Allow access from everywhere |
| 54 | access-control: 0.0.0.0/0 allow | |
| d0e5f71f | 55 | |
| 211b6bc1 JS |
56 | # Timeout behaviour |
| 57 | infra-keep-probing: yes | |
| 58 | ||
| b8f5eda8 | 59 | # Bootstrap root servers |
| d0e5f71f ML |
60 | root-hints: "/etc/unbound/root.hints" |
| 61 | ||
| b8f5eda8 MT |
62 | # Include DHCP leases |
| 63 | include: "/etc/unbound/dhcp-leases.conf" | |
| d0e5f71f | 64 | |
| 6137797c MT |
65 | # Include hosts |
| 66 | include: "/etc/unbound/hosts.conf" | |
| 67 | ||
| b8f5eda8 MT |
68 | # Include any forward zones |
| 69 | include: "/etc/unbound/forward.conf" | |
| d0e5f71f | 70 | |
| d0e5f71f ML |
71 | remote-control: |
| 72 | control-enable: yes | |
| 9bc17600 | 73 | control-use-cert: no |
| d0e5f71f | 74 | control-interface: 127.0.0.1 |
| d0e5f71f | 75 | |
| b8f5eda8 MT |
76 | # Import any local configurations |
| 77 | include: "/etc/unbound/local.d/*.conf" |