config/unbound/unbound.conf

   1 #
   2 # Unbound configuration file for IPFire
   3 #
   4 # The full documentation is available at:
   5 # https://www.unbound.net/documentation/unbound.conf.html
   6 #
   7
   8 server:
   9         # Common Server Options
  10         chroot: ""
  11         directory: "/etc/unbound"
  12         username: "nobody"
  13         num-threads: 2
  14         port: 53
  15         do-ip4: yes
  16         do-ip6: no
  17         do-udp: yes
  18         do-tcp: yes
  19         so-reuseport: yes
  20         do-not-query-localhost: yes
  21
  22         # Logging Options
  23         verbosity: 1
  24         use-syslog: yes
  25         log-time-ascii: yes
  26         log-queries: no
  27
  28         # Unbound Statistics
  29         statistics-interval: 0
  30         statistics-cumulative: yes
  31         extended-statistics: yes
  32
  33         # Cache Sizes
  34         msg-cache-size: 8m
  35         rrset-cache-size: 8m
  36         key-cache-size: 4m
  37         prefetch: yes
  38         prefetch-key: yes
  39
  40         # Randomise any cached responses
  41         rrset-roundrobin: yes
  42
  43         # Privacy Options
  44         hide-identity: yes
  45         hide-version: yes
  46         qname-minimisation: yes
  47         minimal-responses: yes
  48
  49         # DNSSEC
  50         auto-trust-anchor-file: "/var/lib/unbound/root.key"
  51         val-permissive-mode: no
  52         val-clean-additional: yes
  53         val-log-level: 1
  54
  55         # Hardening Options
  56         harden-glue: yes
  57         harden-short-bufsize: no
  58         harden-large-queries: yes
  59         harden-dnssec-stripped: yes
  60         harden-below-nxdomain: yes
  61         harden-referral-path: yes
  62         harden-algo-downgrade: no
  63         use-caps-for-id: no
  64
  65         # Deny access from everywhere
  66         access-control: 0.0.0.0/0 refuse
  67
  68         # Listen on localhost
  69         interface: 127.0.0.1
  70         access-control: 127.0.0.0/8 allow
  71
  72         # Bootstrap root servers
  73         root-hints: "/etc/unbound/root.hints"
  74
  75         # IPFire interface configuration
  76         include: "/etc/unbound/interfaces.conf"
  77         interface-automatic: no
  78
  79         # Include DHCP leases
  80         include: "/etc/unbound/dhcp-leases.conf"
  81
  82         # Include any forward zones
  83         include: "/etc/unbound/forward.conf"
  84
  85 remote-control:
  86         control-enable: yes
  87         control-use-cert: yes
  88         control-interface: 127.0.0.1
  89         server-key-file: "/etc/unbound/unbound_server.key"
  90         server-cert-file: "/etc/unbound/unbound_server.pem"
  91         control-key-file: "/etc/unbound/unbound_control.key"
  92         control-cert-file: "/etc/unbound/unbound_control.pem"
  93
  94 # Import any local configurations
  95 include: "/etc/unbound/local.d/*.conf"