projects / people / pmueller / ipfire-2.x.git / blame
| Commit | Line | Data |
|---|---|---|
| d0e5f71f ML |
1 | # |
| 2 | # Unbound configuration file for IPFire | |
| 3 | # | |
| 4 | # The full documentation is available at: | |
| 5 | # https://www.unbound.net/documentation/unbound.conf.html | |
| 6 | # | |
| 7 | ||
| 8 | server: | |
| b8f5eda8 MT |
9 | # Common Server Options |
| 10 | chroot: "" | |
| 11 | directory: "/etc/unbound" | |
| 12 | username: "nobody" | |
| d0e5f71f ML |
13 | port: 53 |
| 14 | do-ip4: yes | |
| 15 | do-ip6: no | |
| 16 | do-udp: yes | |
| 17 | do-tcp: yes | |
| d0e5f71f | 18 | so-reuseport: yes |
| d0e5f71f ML |
19 | do-not-query-localhost: yes |
| 20 | ||
| b658a451 MT |
21 | # System Tuning |
| 22 | include: "/etc/unbound/tuning.conf" | |
| 23 | ||
| b8f5eda8 | 24 | # Logging Options |
| d0e5f71f | 25 | verbosity: 1 |
| b8f5eda8 | 26 | use-syslog: yes |
| d0e5f71f | 27 | log-time-ascii: yes |
| b8f5eda8 | 28 | log-queries: no |
| d0e5f71f ML |
29 | |
| 30 | # Unbound Statistics | |
| b8f5eda8 | 31 | statistics-interval: 0 |
| d0e5f71f ML |
32 | statistics-cumulative: yes |
| 33 | extended-statistics: yes | |
| 34 | ||
| b658a451 | 35 | # Prefetching |
| b8f5eda8 MT |
36 | prefetch: yes |
| 37 | prefetch-key: yes | |
| 38 | ||
| 39 | # Randomise any cached responses | |
| 40 | rrset-roundrobin: yes | |
| 41 | ||
| 42 | # Privacy Options | |
| d0e5f71f ML |
43 | hide-identity: yes |
| 44 | hide-version: yes | |
| 45 | qname-minimisation: yes | |
| 46 | minimal-responses: yes | |
| 47 | ||
| b8f5eda8 MT |
48 | # DNSSEC |
| 49 | auto-trust-anchor-file: "/var/lib/unbound/root.key" | |
| 50 | val-permissive-mode: no | |
| 51 | val-clean-additional: yes | |
| 52 | val-log-level: 1 | |
| 53 | ||
| 54 | # Hardening Options | |
| d0e5f71f | 55 | harden-glue: yes |
| b8f5eda8 | 56 | harden-short-bufsize: no |
| d0e5f71f ML |
57 | harden-large-queries: yes |
| 58 | harden-dnssec-stripped: yes | |
| b8f5eda8 MT |
59 | harden-below-nxdomain: yes |
| 60 | harden-referral-path: yes | |
| d0e5f71f | 61 | harden-algo-downgrade: no |
| b8f5eda8 | 62 | use-caps-for-id: no |
| d0e5f71f | 63 | |
| 1b4d5ad9 MT |
64 | # Listen on all interfaces |
| 65 | interface: 0.0.0.0 | |
| 66 | ||
| b8f5eda8 | 67 | # Deny access from everywhere |
| d0e5f71f | 68 | access-control: 0.0.0.0/0 refuse |
| d0e5f71f | 69 | |
| 1b4d5ad9 | 70 | # Allow access from localhost |
| b8f5eda8 | 71 | access-control: 127.0.0.0/8 allow |
| d0e5f71f | 72 | |
| b8f5eda8 | 73 | # Bootstrap root servers |
| d0e5f71f ML |
74 | root-hints: "/etc/unbound/root.hints" |
| 75 | ||
| b8f5eda8 MT |
76 | # IPFire interface configuration |
| 77 | include: "/etc/unbound/interfaces.conf" | |
| 78 | interface-automatic: no | |
| d0e5f71f | 79 | |
| b8f5eda8 MT |
80 | # Include DHCP leases |
| 81 | include: "/etc/unbound/dhcp-leases.conf" | |
| d0e5f71f | 82 | |
| b8f5eda8 MT |
83 | # Include any forward zones |
| 84 | include: "/etc/unbound/forward.conf" | |
| d0e5f71f | 85 | |
| d0e5f71f ML |
86 | remote-control: |
| 87 | control-enable: yes | |
| 88 | control-use-cert: yes | |
| 89 | control-interface: 127.0.0.1 | |
| 90 | server-key-file: "/etc/unbound/unbound_server.key" | |
| 91 | server-cert-file: "/etc/unbound/unbound_server.pem" | |
| 92 | control-key-file: "/etc/unbound/unbound_control.key" | |
| 93 | control-cert-file: "/etc/unbound/unbound_control.pem" | |
| d0e5f71f | 94 | |
| b8f5eda8 MT |
95 | # Import any local configurations |
| 96 | include: "/etc/unbound/local.d/*.conf" |