unbound: Add Safe Search
[ipfire-2.x.git] / config / unbound / unbound.conf
CommitLineData
d0e5f71f
ML
1#
2# Unbound configuration file for IPFire
3#
4# The full documentation is available at:
5# https://www.unbound.net/documentation/unbound.conf.html
6#
7
8server:
b8f5eda8
MT
9 # Common Server Options
10 chroot: ""
11 directory: "/etc/unbound"
12 username: "nobody"
d0e5f71f
ML
13 port: 53
14 do-ip4: yes
15 do-ip6: no
16 do-udp: yes
17 do-tcp: yes
d0e5f71f 18 so-reuseport: yes
d0e5f71f
ML
19 do-not-query-localhost: yes
20
b658a451
MT
21 # System Tuning
22 include: "/etc/unbound/tuning.conf"
23
b8f5eda8 24 # Logging Options
d0e5f71f 25 verbosity: 1
b8f5eda8 26 use-syslog: yes
d0e5f71f 27 log-time-ascii: yes
b8f5eda8 28 log-queries: no
d0e5f71f
ML
29
30 # Unbound Statistics
2e0660f9 31 statistics-interval: 86400
d0e5f71f
ML
32 statistics-cumulative: yes
33 extended-statistics: yes
34
b658a451 35 # Prefetching
b8f5eda8
MT
36 prefetch: yes
37 prefetch-key: yes
38
39 # Randomise any cached responses
40 rrset-roundrobin: yes
41
42 # Privacy Options
d0e5f71f
ML
43 hide-identity: yes
44 hide-version: yes
c2adb460 45 qname-minimisation: yes
d0e5f71f
ML
46 minimal-responses: yes
47
b8f5eda8
MT
48 # DNSSEC
49 auto-trust-anchor-file: "/var/lib/unbound/root.key"
50 val-permissive-mode: no
51 val-clean-additional: yes
52 val-log-level: 1
53
54 # Hardening Options
d0e5f71f 55 harden-glue: yes
b8f5eda8 56 harden-short-bufsize: no
d0e5f71f
ML
57 harden-large-queries: yes
58 harden-dnssec-stripped: yes
c2adb460 59 harden-below-nxdomain: yes
b8f5eda8 60 harden-referral-path: yes
d0e5f71f 61 harden-algo-downgrade: no
4e4128fa 62 use-caps-for-id: yes
8a058583 63 aggressive-nsec: yes
d0e5f71f 64
ffba3c98
PM
65 # Harden against DNS cache poisoning
66 unwanted-reply-threshold: 1000000
67
1b4d5ad9 68 # Listen on all interfaces
d4af85f2 69 interface-automatic: yes
1b4d5ad9
MT
70 interface: 0.0.0.0
71
3ddad158
MT
72 # Allow access from everywhere
73 access-control: 0.0.0.0/0 allow
d0e5f71f 74
b8f5eda8 75 # Bootstrap root servers
d0e5f71f
ML
76 root-hints: "/etc/unbound/root.hints"
77
b8f5eda8
MT
78 # Include DHCP leases
79 include: "/etc/unbound/dhcp-leases.conf"
d0e5f71f 80
b8f5eda8
MT
81 # Include any forward zones
82 include: "/etc/unbound/forward.conf"
d0e5f71f 83
661ab153
MT
84 # Include safe search settings
85 include: "/etc/unbound/safe-search.conf"
86
d0e5f71f
ML
87remote-control:
88 control-enable: yes
9bc17600 89 control-use-cert: no
d0e5f71f 90 control-interface: 127.0.0.1
d0e5f71f 91
b8f5eda8
MT
92# Import any local configurations
93include: "/etc/unbound/local.d/*.conf"