| | 1 | # |
| | 2 | # Unbound configuration file for IPFire |
| | 3 | # |
| | 4 | # The full documentation is available at: |
| | 5 | # https://nlnetlabs.nl/documentation/unbound/unbound.conf/ |
| | 6 | # |
| | 7 | |
| | 8 | server: |
| | 9 | # Common Server Options |
| | 10 | chroot: "" |
| | 11 | directory: "/etc/unbound" |
| | 12 | username: "nobody" |
| | 13 | do-ip6: no |
| | 14 | |
| | 15 | # System Tuning |
| | 16 | include: "/etc/unbound/tuning.conf" |
| | 17 | |
| | 18 | # Logging Options |
| | 19 | use-syslog: yes |
| | 20 | log-time-ascii: yes |
| | 21 | |
| | 22 | # Unbound Statistics |
| | 23 | statistics-interval: 86400 |
| | 24 | extended-statistics: yes |
| | 25 | |
| | 26 | # Prefetching |
| | 27 | prefetch: yes |
| | 28 | prefetch-key: yes |
| | 29 | |
| | 30 | # Randomise any cached responses |
| | 31 | rrset-roundrobin: yes |
| | 32 | |
| | 33 | # Privacy Options |
| | 34 | hide-identity: yes |
| | 35 | hide-version: yes |
| | 36 | |
| | 37 | # DNSSEC |
| | 38 | auto-trust-anchor-file: "/var/lib/unbound/root.key" |
| | 39 | val-log-level: 1 |
| | 40 | log-servfail: yes |
| | 41 | |
| | 42 | # Hardening Options |
| | 43 | harden-large-queries: yes |
| | 44 | harden-referral-path: yes |
| | 45 | aggressive-nsec: yes |
| | 46 | |
| | 47 | # TLS |
| | 48 | tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt |
| | 49 | |
| | 50 | # EDNS Buffer Size (#12240) |
| | 51 | edns-buffer-size: 1232 |
| | 52 | |
| | 53 | # Harden against DNS cache poisoning |
| | 54 | unwanted-reply-threshold: 1000000 |
| | 55 | |
| | 56 | # Listen on all interfaces |
| | 57 | interface-automatic: yes |
| | 58 | interface: 0.0.0.0 |
| | 59 | |
| | 60 | # Allow access from everywhere |
| | 61 | access-control: 0.0.0.0/0 allow |
| | 62 | |
| | 63 | # Bootstrap root servers |
| | 64 | root-hints: "/etc/unbound/root.hints" |
| | 65 | |
| | 66 | # Include DHCP leases |
| | 67 | include: "/etc/unbound/dhcp-leases.conf" |
| | 68 | |
| | 69 | # Include hosts |
| | 70 | include: "/etc/unbound/hosts.conf" |
| | 71 | |
| | 72 | # Include any forward zones |
| | 73 | include: "/etc/unbound/forward.conf" |
| | 74 | |
| | 75 | remote-control: |
| | 76 | control-enable: yes |
| | 77 | control-use-cert: no |
| | 78 | control-interface: 127.0.0.1 |
| | 79 | |
| | 80 | # Import any local configurations |
| | 81 | include: "/etc/unbound/local.d/*.conf" |
projects / people / pmueller / ipfire-2.x.git / blame_incremental