config/unbound/unbound.conf

   1 #
   2 # Unbound configuration file for IPFire
   3 #
   4 # The full documentation is available at:
   5 # https://nlnetlabs.nl/documentation/unbound/unbound.conf/
   6 #
   7
   8 server:
   9         # Common Server Options
  10         chroot: ""
  11         directory: "/etc/unbound"
  12         username: "nobody"
  13         do-ip6: no
  14
  15         # System Tuning
  16         include: "/etc/unbound/tuning.conf"
  17
  18         # Logging Options
  19         use-syslog: yes
  20         log-time-ascii: yes
  21
  22         # Unbound Statistics
  23         statistics-interval: 86400
  24         extended-statistics: yes
  25
  26         # Prefetching
  27         prefetch: yes
  28         prefetch-key: yes
  29
  30         # Randomise any cached responses
  31         rrset-roundrobin: yes
  32
  33         # Privacy Options
  34         hide-identity: yes
  35         hide-version: yes
  36
  37         # DNSSEC
  38         auto-trust-anchor-file: "/var/lib/unbound/root.key"
  39         val-log-level: 1
  40         log-servfail: yes
  41
  42         # Hardening Options
  43         harden-large-queries: yes
  44         harden-referral-path: yes
  45         use-caps-for-id: yes
  46         aggressive-nsec: yes
  47
  48         # TLS
  49         tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt
  50
  51         # EDNS Buffer Size (#12240)
  52         edns-buffer-size: 1232
  53
  54         # Harden against DNS cache poisoning
  55         unwanted-reply-threshold: 1000000
  56
  57         # Listen on all interfaces
  58         interface-automatic: yes
  59         interface: 0.0.0.0
  60
  61         # Allow access from everywhere
  62         access-control: 0.0.0.0/0 allow
  63
  64         # Bootstrap root servers
  65         root-hints: "/etc/unbound/root.hints"
  66
  67         # Include DHCP leases
  68         include: "/etc/unbound/dhcp-leases.conf"
  69
  70         # Include hosts
  71         include: "/etc/unbound/hosts.conf"
  72
  73         # Include any forward zones
  74         include: "/etc/unbound/forward.conf"
  75
  76 remote-control:
  77         control-enable: yes
  78         control-use-cert: no
  79         control-interface: 127.0.0.1
  80
  81 # Import any local configurations
  82 include: "/etc/unbound/local.d/*.conf"