]>
Commit | Line | Data |
---|---|---|
d0e5f71f ML |
1 | # |
2 | # Unbound configuration file for IPFire | |
3 | # | |
4 | # The full documentation is available at: | |
e737776d | 5 | # https://nlnetlabs.nl/documentation/unbound/unbound.conf/ |
d0e5f71f ML |
6 | # |
7 | ||
8 | server: | |
b8f5eda8 MT |
9 | # Common Server Options |
10 | chroot: "" | |
11 | directory: "/etc/unbound" | |
12 | username: "nobody" | |
d0e5f71f | 13 | do-ip6: no |
d0e5f71f | 14 | |
b658a451 MT |
15 | # System Tuning |
16 | include: "/etc/unbound/tuning.conf" | |
17 | ||
b8f5eda8 | 18 | # Logging Options |
b8f5eda8 | 19 | use-syslog: yes |
d0e5f71f ML |
20 | log-time-ascii: yes |
21 | ||
22 | # Unbound Statistics | |
2e0660f9 | 23 | statistics-interval: 86400 |
d0e5f71f ML |
24 | extended-statistics: yes |
25 | ||
b658a451 | 26 | # Prefetching |
b8f5eda8 MT |
27 | prefetch: yes |
28 | prefetch-key: yes | |
29 | ||
30 | # Randomise any cached responses | |
31 | rrset-roundrobin: yes | |
32 | ||
33 | # Privacy Options | |
d0e5f71f ML |
34 | hide-identity: yes |
35 | hide-version: yes | |
d0e5f71f | 36 | |
b8f5eda8 MT |
37 | # DNSSEC |
38 | auto-trust-anchor-file: "/var/lib/unbound/root.key" | |
b8f5eda8 | 39 | val-log-level: 1 |
e737776d | 40 | log-servfail: yes |
b8f5eda8 MT |
41 | |
42 | # Hardening Options | |
d0e5f71f | 43 | harden-large-queries: yes |
b8f5eda8 | 44 | harden-referral-path: yes |
8a058583 | 45 | aggressive-nsec: yes |
d0e5f71f | 46 | |
ffc46751 MT |
47 | # TLS |
48 | tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt | |
49 | ||
372576e0 MT |
50 | # EDNS Buffer Size (#12240) |
51 | edns-buffer-size: 1232 | |
d0e5f71f | 52 | |
ffba3c98 PM |
53 | # Harden against DNS cache poisoning |
54 | unwanted-reply-threshold: 1000000 | |
55 | ||
1b4d5ad9 | 56 | # Listen on all interfaces |
d4af85f2 | 57 | interface-automatic: yes |
1b4d5ad9 MT |
58 | interface: 0.0.0.0 |
59 | ||
3ddad158 MT |
60 | # Allow access from everywhere |
61 | access-control: 0.0.0.0/0 allow | |
d0e5f71f | 62 | |
b8f5eda8 | 63 | # Bootstrap root servers |
d0e5f71f ML |
64 | root-hints: "/etc/unbound/root.hints" |
65 | ||
b8f5eda8 MT |
66 | # Include DHCP leases |
67 | include: "/etc/unbound/dhcp-leases.conf" | |
d0e5f71f | 68 | |
6137797c MT |
69 | # Include hosts |
70 | include: "/etc/unbound/hosts.conf" | |
71 | ||
b8f5eda8 MT |
72 | # Include any forward zones |
73 | include: "/etc/unbound/forward.conf" | |
d0e5f71f | 74 | |
d0e5f71f ML |
75 | remote-control: |
76 | control-enable: yes | |
9bc17600 | 77 | control-use-cert: no |
d0e5f71f | 78 | control-interface: 127.0.0.1 |
d0e5f71f | 79 | |
b8f5eda8 MT |
80 | # Import any local configurations |
81 | include: "/etc/unbound/local.d/*.conf" |