[Solved] Unbound installation

[NanoCode012]

Hello, I was also looking to install unbound with pihole for some extra privacy. May I ask if there are any documentations on this or I should follow pihole's instructions?

https://docs.pi-hole.net/guides/dns/unbound/

I am not sure if it would conflict with DoH? Would this require disabling DoH in favor unbound?

[chadgeary]

Hey - cloudblock does not use unbound (and the benefits are speculative / a trade off). It's up to you to weigh the pros and cons (and whom you trust).

1. Unbound / cloudflared(cloudblock's method) encrypted DNS: pihole's lookups will be visible to the DoH/DoT provider (and potentially upstream from it), here's an example list of DoH providers:

          adguard https://dns.adguard.com/dns-query
          cloudflare https://cloudflare-dns.com/dns-query
          applied-privacy https://doh.applied-privacy.net/query
          google https://dns.google/dns-query
          hurricane-electric https://ordns.he.net/dns-query
          pi-dns https://doh.pi-dns.com/dns-query
          quad9-recommended https://dns.quad9.net/dns-query
          libre-dns https://doh.libredns.gr/dns-query
          opendns https://doh.opendns.com/dns-query

2. Unbound recursive mode: root DNS servers do not support DNS transport encryption (DoH / DoT) - ergo pihole's lookups will be visible to any transit connections between the pihole and root DNS servers, e.g. cloud provider, transit between provider and dns servers, dns provider.
3. Unbound can be slow to cache initial recursive lookups

Neither solution is perfect, but I (personally) weight some DoH providers with a higher trust than cloud providers and public internet transit.

If you are interested in running unbound, try the docker variant and ensure its running on the same network as the pihole - its called cloudblock and is visible after ssh to the cloudblock machine and running sudo docker network ls and sudo docker network inspect cloudblock

This script will deploy unbound on your cloudblock machine - you'll need to login to the pihole webUI and change both DNS servers (Custom 1 and Custom 2) from 172.18.0.2 to 172.18.0.6:

sudo apt update && sudo apt -y install docker-compose
mkdir -p ~/unbound/ && cd ~/unbound/

tee docker-compose.yml << EOM
version: "3"

services:
  unbound:
    image: "mvance/unbound:latest"
    container_name: unbound
    restart: unless-stopped
    hostname: "unbound"
    volumes:
      - "./unbound.conf:/opt/unbound/etc/unbound/unbound.conf"
    networks:
      cloudblock:
        ipv4_address: 172.18.0.6

networks:
   cloudblock:
    external: true
EOM

tee unbound.conf << EOM
server:
    cache-max-ttl: 86400
    cache-min-ttl: 60
    directory: "/opt/unbound/etc/unbound"
    edns-buffer-size: 1472
    interface: 0.0.0.0@53
    rrset-roundrobin: yes
    username: "_unbound"
    log-local-actions: no
    log-queries: no
    log-replies: no
    log-servfail: no
    logfile: /dev/null
    verbosity: 1
    aggressive-nsec: yes
    delay-close: 10000
    do-daemonize: no
    do-not-query-localhost: no
    neg-cache-size: 4M
    qname-minimisation: yes
    access-control: 127.0.0.1/32 allow
    access-control: 172.16.0.0/12 allow
    auto-trust-anchor-file: "var/root.key"
    chroot: "/opt/unbound/etc/unbound"
    harden-algo-downgrade: yes
    harden-below-nxdomain: yes
    harden-dnssec-stripped: yes
    harden-glue: yes
    harden-large-queries: yes
    harden-referral-path: no
    harden-short-bufsize: yes
    hide-identity: yes
    hide-version: yes
    identity: "UNBND"
    private-address: 172.16.0.0/12
    tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
    unwanted-reply-threshold: 10000000
    val-clean-additional: yes
    msg-cache-size: 260991658
    num-queries-per-thread: 4096
    outgoing-range: 8192
    rrset-cache-size: 260991658
    minimal-responses: yes
    prefetch: yes
    prefetch-key: yes
    serve-expired: yes
    so-reuseport: yes
    so-rcvbuf: 1m
    remote-control:
        control-enable: no
python:
dynlib:
remote-control:

EOM

sudo docker-compose up

[NanoCode012]

Wow, thank you very much @chadgeary for the detailed reply. I think you could even add this to your ReadMe :) I will consider whether to run unbound after this.