Back to [[BernardSpil/HomeServer|HomeServer]]

====== Why ======
I was done with all companies sleuthing information (this includes your DNS requests when they can!)\\ 
I wanted to be able to use DNSSEC and DANE\\ 
Without losing the dynamic DHCP/DNS capability from dnsmasq\\ 

====== Software ======
  - [[http://freshports.org/dns/dnsmasq|dnsmasq]] for DHCP and dynamic DNS
  - [[http://freshports.org/dns/unbound|Unbound]] as validating, caching and recursive DNS resolver

====== How ======
There were 2 ways of doing this
  - Make dnsmasq the primary DNS server on my LAN and use Unbound as the recursive resolver
  - Make Unbound the primary DNS server on my LAN and make it use dnsmasq for my LAN (and domains)
I chose 2 assuming that Unbound is more geared towards performance and security than dnsmasq is

===== Configuring Unbound =====
This was amazingly simple to do, but Unbound is a bit daunting with the amount of features it has. I've boiled it down to

<code python>
server:
        verbosity: 1
        num-threads: 1
        interface: 192.0.2.1
        access-control: 192.0.2.1/24 allow
        chroot: "/usr/local/etc/unbound"
        username: "unbound"
        directory: "/usr/local/etc/unbound"
        use-syslog: yes
        pidfile: "/var/run/unbound/unbound.pid"

        # Tune for lower memory usage
        outgoing-num-tcp: 1
        incoming-num-tcp: 1
        outgoing-range: 60
        msg-buffer-size: 8192
        msg-cache-size: 100k
        msg-cache-slabs: 1
        rrset-cache-size: 100k
        rrset-cache-slabs: 1
        infra-cache-numhosts: 1000
        infra-cache-slabs: 1
        key-cache-size: 100k
        key-cache-slabs: 1
        neg-cache-size: 10k
        num-queries-per-thread: 30
        target-fetch-policy: "2 1 0 0 0 0"

        hide-identity: yes
        hide-version: yes
        harden-short-bufsize: yes
        harden-large-queries: yes
        harden-glue: yes
        harden-dnssec-stripped: yes
        harden-below-nxdomain: yes

        private-address: 192.0.2.0/24
        private-domain: "example.net"
        private-domain: "example.org"
        do-not-query-localhost: yes

        module-config: "validator iterator"
        auto-trust-anchor-file: "/usr/local/etc/unbound/root.key"
        dlv-anchor-file: "dlv.isc.org.key"

        val-clean-additional: yes
        local-zone: "0.192.in-addr.arpa." nodefault
        unblock-lan-zones: yes

stub-zone:
        name: "example.net"
        stub-addr: 192.0.2.1@5353

stub-zone:
        name: "example.org"
        stub-addr: 192.0.2.1@5353
</code>

  - pidfile: "/var/run/unbound/unbound.pid"
The default config is for the pid-file to be in /usr/local/etc/unbound which is not as per [[https://www.freebsd.org/cgi/man.cgi?query=hier&sektion=7|hier(7)]] and as per Unbound's documentation not required to be inside the chroot.

<code>
mkdir -p /var/run/unbound
chown unbound /var/run/unbound
</code>

  - interface: 192.168.100.1
  - stub-addr: 192.0.2.0@5353
Unbound listens on the default dns port, dnsmasq on port 5353

===== dnsmasq configuration =====

<code bash>
domain-needed
bogus-priv
expand-hosts

no-resolv

listen-address=192.0.2.1
port=5353

domain=example.net,192.0.2.0/24,local
domain=example.org,192.0.2.0/24,local

dhcp-range=192.0.2.100,192.0.2.199,255.255.255.0,24h
dhcp-range=::,constructor:em0, ra-stateless, ra-names

dhcp-host=somehost
dhcp-host=anotherhost

dhcp-option=option:router,192.0.2.254
dhcp-option=option:dns-server,192.0.2.1
dhcp-option=option:ntp-server,192.0.2.1
dhcp-option=option:domain-search,example.org,example.net
dhcp-option=54,192.0.2.1      # DHCP Server Id

dhcp-option=option6:dns-server,[::]
dhcp-option=option6:information-refresh-time,6h

dhcp-option=19,0           # option ip-forwarding off
dhcp-option=44,192.0.2.1   # set netbios-over-TCP/IP nameserver(s) aka WINS server(s)
dhcp-option=45,0.0.0.0     # netbios datagram distribution server
dhcp-option=46,8           # netbios node type
dhcp-option=252,"\n"       # please Windows 7

mx-target=smtp.example.org
localmx
selfmx

srv-host=_ldap._tcp.example.org,example.org,389
</code>

  - Give fixed IP-address to host defined in /etc/hosts