# Unbound Recursive DNS Server with UCI

## Unbound Description

[Unbound](https://www.unbound.net/) is a validating, recursive, and caching DNS resolver. The C implementation of Unbound is developed and maintained by [NLnet Labs](https://www.nlnetlabs.nl/). It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modular components, so that also DNSSEC (secure DNS) validation and stub-resolvers (that do not run as a server, but are linked into an application) are easily possible.

| --- | ------- | ----- | ----------- | ------- |

| add_extra_dns | 0 | level | Read OpenWrt traditional options for `dnsmasq`.<br>`0`: Disabled<br>`1`: Use only domain<br>`2`: Use domain, mxhost, and srvhost<br>`3`: Use all cname, domain, mxhost, and srvhost | local-data: |

| add_local_fqdn | 0 | level | Each level puts a more detailed router entry within the LAN DNS (except link).<br>`0`: Disabled<br>`1`: Host name on the primary address<br>`2`: Host name on all addresses<br>`3`: FQDN and host name on all addresses<br>`4`: FQDN defined by "iface.hostname.domain" | local-zone: local-data: |

| dns64 | 0 | boolean | Enable DNS64 RFC6052 to bridge IPv4 and IPv6 networks. | module: dns64 |

| dns64_prefix | 64:ff9b::/96 | subnet | DNS64 RFC6052 IPv4 in IPv6 well known prefix. | dns64-prefix: |

| dhcp_link | none | program | Link to a DHCP server with supported scripts. See HOW TO above. | local-zone: local-data: forward-zone: |

| domain | lan | domain | This will suffix DHCP host records and be the default search domain. | local-zone: |

| domain_insecure | (empty) | domain | **List** domains that you wish to skip DNSSEC. It is one way around NTP chicken and egg. Your DHCP domains are automatically included. | domain-insecure: |

| domain_type | static | state | This allows you to lock down or allow forwarding of the local zone.<br>`static`: no forwarding like dnsmasq default<br>`refuse`: answer overtly with REFUSED<br>`deny`: covertly drop all queries<br>`transparent`: may continue forwarding or recusion | local-zone: |

| extended_stats | 0 | boolean | Extended statistics are stored in Unbound memory for report by `unbound-control`. | extended-statistics: |

| hide_binddata | 1 | boolean | Refuse possible attack queries like version.server, version.bind, id.server, and hostname.bind. | hide-identity: hide-version: |

| listen_port | 53 | port | Inbound port where Unbound will listen for queries. | port: |

| localservice | 1 | boolean | Prevent DNS amplification attacks. Only answer to subnets this machine has interfaces on. | access-control: |

| manual_conf | 0 | boolean | Skip all this UCI nonsense. Manually edit the configuration in `/etc/unbound/unbound.conf`. | - |

| recursion | passive | state | Unbound has many options for recrusion but UCI is bundled for simplicity.<br>`passive`: slower until cache fills but kind on CPU load<br>`default`: built-in defaults<br>`aggressive`: uses prefetching to handle more requests quickly | (many) |

| resource | small | state | Unbound has many options for memory resources but UCI is bundled for simplicity.<br>`tiny`: similar to published memory restricted configuration<br>`small`: about half of medium<br>`medium`: similar to default<br>`default`: built-in defaults<br>`large`: about double of medium | \*-cache-size: |

| root_age | 9 | day | >90 Disables. Age limit for root data like root DNSSEC key. Scripts will copy from `tmps` to flash ROM with this limit to save write life. | - |

| ttl_min | 120 | second | Minimum TTL in cache to avoid abused low TTL for snoop-vertising and non-standard load balancing. Typical to configure maybe 0~300 but 1800 is the maximum accepted. | cache-min-ttl: |

| unbound_control | 0 | level | Enables `unbound-control` application access ports.<br>`0`: None else add your own in unbound_ext.conf<br>`1`: Unencrypted Local Host Access<br>`2`: SSL Local Host Access w/ auto unbound-control-setup<br>`3`: SSL Network Access w/ auto unbound-control-setup<br>`4`: SSL Network Access; static key/pem files must already exist | unbound-control: ... (clause) |

| validator | 0 | boolean | Enable DNSSEC validator module. | module: validator |

Confingure any mix of Unbound `forward-zone:`, `stub-zone:`, or `auth-zone:` clauses. These sections are more compact than Unbound and will unroll into Unbound's configuration syntax.

| UCI | Default | Units | Description | Unbound |

| --- | ------- | ----- | ----------- | ------- |

| enabled | 0 | boolean | turn zone on or off without deleting it | - |

| fallback | 1 | boolean | Allow this zone to fall through to other zones or recursion. | forward-first: |

| port | 53 | port | Target server's target port for plain DNS operations. | (auto 192.0.2.53 \#53)

#

##############################################################################

# where are we?

UB_LIBDIR=/usr/lib/unbound

UB_VARDIR=/var/lib/unbound

UB_PIDFILE=/var/run/unbound.pid

# TLS keys

UB_TLS_KEY_FILE="TLS server UCI not implemented"

UB_TLS_PEM_FILE="TLS server UCI not implemented"

UB_TLS_ETC_FILE=/etc/ssl/certs/ca-certificates.crt

# start files

UB_SKIP_FILE=$UB_VARDIR/skip.time

# control app keys

# similar default SOA / NS RR as Unbound uses for private ARPA zones

UB_XSER=$(( $( date +%s ) / 60 ))

#

##############################################################################

DM_D_WAN_FQDN=0

DM_LIST_KNOWN_ZONES="invalid"

#

##############################################################################

domain_ptr_ip6() {

# Get the nibble rounded /CIDR ...ip6.arpa.

echo "$1" | awk -F: \

#

##############################################################################

odhcpd_zonedata() {

. /lib/functions.sh

. /usr/lib/unbound/defaults.sh

#

##############################################################################

. /usr/lib/unbound/defaults.sh

##############################################################################

#

##############################################################################

START=19

STOP=50

USE_PROCD=1

##############################################################################

service_triggers() {

. /usr/lib/unbound/defaults.sh

#

##############################################################################

. /usr/lib/unbound/defaults.sh

##############################################################################

date -Is > $UB_TIME_FILE

/etc/init.d/unbound enabled && /etc/init.d/unbound restart

# Yes, hard RESTART. We need to be absolutely sure to enable DNSSEC.

#

##############################################################################

UB_B_AUTH_ROOT=0

UB_B_DNS_ASSIST=0

UB_B_DNSSEC=0

UB_IP_DNS64="64:ff9b::/96"

UB_N_RX_PORT=53

UB_N_ROOT_AGE=9

UB_N_THREADS=1

##############################################################################

local cfg="$1"

local interface ifsubnet ifname ifdashname ignore

##############################################################################

bundle_wan_networks() {

for ifsubnet in $UB_LIST_NETW_ALL ; do

case $UB_LIST_NETW_LAN in

*"${ifsubnet}"*)

;;

*)

;;

esac

done

mkdir -p $UB_VARDIR

rm -f $UB_VARDIR/dhcp_*

touch $UB_TOTAL_CONF

if [ ! -f $UB_RHINT_FILE ] ; then

fi

# Ensure access and prepare to jail

chown -R unbound:unbound $UB_VARDIR

chmod 755 $UB_VARDIR

chmod 644 $UB_VARDIR/*

fi

fi

;;

ipset-dns)

if [ -x /usr/sbin/ipset-dns ] && [ -x /etc/init.d/ipset-dns ] ; then

if /etc/init.d/ipset-dns enabled ; then

fi

;;

*)

dns_ast=0

esac

;;

forward_zone)

logger -p 4 -t unbound -s \

"Forward-zone TLS benefits from authentication in package 'ca-bundle'"

fi

else

case $server in

*@[0-9]*|*#[A-Za-z0-9]*)

# unique Unbound option for server host name

servers_host="$servers_host $server"

} > $UB_CORE_CONF

# TLS cert bundle for upstream forwarder and https zone files

# This is loaded before drop to root, so pull from /etc/ssl

fi

if [ $UB_B_EXT_STATS -gt 0 ] ; then

{

echo " extended-statistics: yes"

echo

} >> $UB_CORE_CONF

else

{

echo " extended-statistics: no"

echo

} >> $UB_CORE_CONF

fi

case "$UB_D_PROTOCOL" in

ip4_only)

{

echo " do-ip4: yes"

echo " do-ip6: no"

echo

ip6_only)

{

echo " do-ip4: no"

echo " do-ip6: yes"

echo

} >> $UB_CORE_CONF

;;

{

echo " do-ip4: yes"

echo " do-ip6: yes"

echo

} >> $UB_CORE_CONF

;;

ip6_prefer)

{

echo " do-ip4: yes"

echo " do-ip6: yes"

echo " prefer-ip6: yes"

echo

} >> $UB_CORE_CONF

mixed)

{

echo " do-ip4: yes"

echo " do-ip6: yes"

echo

if [ $UB_B_READY -eq 0 ] ; then

logger -t unbound -s "default protocol configuration"

fi

;;

esac

fi

{

# Only respond to queries from subnets which have an interface.

# Prevent DNS amplification attacks by not responding to the universe.

echo " access-control: ${ifsubnet#*@} allow"

config_get UB_IP_DNS64 "$cfg" dns64_prefix "64:ff9b::/96"

config_get UB_N_RX_PORT "$cfg" listen_port 53

config_get UB_N_ROOT_AGE "$cfg" root_age 9

config_get UB_N_THREADS "$cfg" num_threads 1

config_get UB_TTL_MIN "$cfg" ttl_min 120

config_get UB_TXT_DOMAIN "$cfg" domain lan

if [ "$UB_D_DHCP_LINK" = "none" ] ; then

config_get_bool UB_B_DNSMASQ "$cfg" dnsmasq_link_dns 0

if [ $UB_N_EDNS_SIZE -lt 512 ] || [ 4096 -lt $UB_N_EDNS_SIZE ] ; then

logger -t unbound -s "edns_size exceeds range, using default"

fi

##############################################################################

unbound_start() {

config_load unbound

config_foreach unbound_uci unbound

unbound_mkdir

# forward-zone: auth-zone: and stub-zone:

config_foreach unbound_zone zone

# associate potential DNS RR with interfaces

config_load dhcp

# server:

unbound_conf

unbound_hostname

option add_extra_dns '0'

option add_local_fqdn '1'

option add_wan_fqdn '0'

option dns64_prefix '64:ff9b::/96'

option domain 'lan'

option domain_type 'static'

option extended_stats '0'

option hide_binddata '1'

option interface_auto '1'

option validator '0'

option validator_ntp '1'

option verbosity '1'

#list domain_insecure 'ntp.example.com'

# cache the root zone all at once to speed up recursion

option enabled '0'

option fallback '1'

list zone_name 'in-addr.arpa.'

list zone_name 'ip6.arpa.'

# forward ISP account management to DHCP announced DNS servers

option enabled '0'

option fallback '1'

list zone_name 'isp-bill.example.com.'

list zone_name 'isp-mail.example.net.'