From c3af6805062b0222be077c8fcaeaa64033e397f1 Mon Sep 17 00:00:00 2001 From: Fijxu Date: Sat, 3 Dec 2022 01:56:42 -0300 Subject: [PATCH] caca --- named.conf | 45 ++++++++++++++++ unbound/unbound.conf.d/caca.conf | 89 ++++++++++++++++++++++++++++++++ 2 files changed, 134 insertions(+) create mode 100644 named.conf create mode 100644 unbound/unbound.conf.d/caca.conf diff --git a/named.conf b/named.conf new file mode 100644 index 0000000..d61b050 --- /dev/null +++ b/named.conf @@ -0,0 +1,45 @@ +// vim:set ts=4 sw=4 et: + +options { + directory "/var/named"; + pid-file "/run/named/named.pid"; + + // Uncomment these to enable IPv6 connections support + // IPv4 will still work: + // listen-on-v6 { any; }; + // Add this for no IPv4: + listen-on port 53 { 127.0.0.1; 186.64.123.31; }; + + allow-recursion { any; }; + allow-query-cache { any; }; + allow-query { any; }; + allow-transfer { none; }; + + max-cache-ttl 30; + max-ncache-ttl 30; + + // version none; + // hostname none; + // server-id none; + recursion yes; + querylog yes; + + # DNSSEC disabled because the main purpose is to use it behind + # this server DoT, dns.zzls.xyz=186.64.123.31 + dnssec-validation no; +}; + +zone "localhost" IN { + type master; + file "localhost.zone"; +}; + +zone "0.0.127.in-addr.arpa" IN { + type master; + file "127.0.0.zone"; +}; + +zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" { + type master; + file "localhost.ip6.zone"; +}; diff --git a/unbound/unbound.conf.d/caca.conf b/unbound/unbound.conf.d/caca.conf new file mode 100644 index 0000000..7f67484 --- /dev/null +++ b/unbound/unbound.conf.d/caca.conf @@ -0,0 +1,89 @@ +# Unbound config file +server: +# If no logfile is specified, syslog is used +#logfile: "/var/log/unbound/unbound.log" +verbosity: 3 + +interface: 127.0.0.1 +interface: 186.64.123.31 +port: 53 +do-ip4: yes +do-udp: yes +do-tcp: yes + +# May be set to yes if you have IPv6 connectivity +do-ip6: no + +# You want to leave this to no unless you have *native* IPv6. With 6to4 and +# Terredo tunnels your web browser should favor IPv4 for the same reasons +prefer-ip6: no + +# Use this only when you downloaded the list of primary root servers! +# If you use the default dns-root-data package, unbound will find it automatically +root-hints: "/etc/unbound/root.hints" + +# Trust glue only if it is within the server's authority +harden-glue: yes + +# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS +harden-dnssec-stripped: yes + +trust-anchor-file: "/etc/unbound/trusted-key.key" + +# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes +# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details +use-caps-for-id: no + +# Reduce EDNS reassembly buffer size. +# IP fragmentation is unreliable on the Internet today, and can cause +# transmission failures when large DNS messages are sent via UDP. Even +# when fragmentation does work, it may not be secure; it is theoretically +# possible to spoof parts of a fragmented DNS message, without easy +# detection at the receiving end. Recently, there was an excellent study +# >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<< +# by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/) +# in collaboration with NLnet Labs explored DNS using real world data from the +# the RIPE Atlas probes and the researchers suggested different values for +# IPv4 and IPv6 and in different scenarios. They advise that servers should +# be configured to limit DNS messages sent over UDP to a size that will not +# trigger fragmentation on typical network links. DNS servers can switch +# from UDP to TCP when a DNS response is too big to fit in this limited +# buffer size. This value has also been suggested in DNS Flag Day 2020. +edns-buffer-size: 1232 + +# Perform prefetching of close to expired message cache entries +# This only applies to domains that have been frequently queried +prefetch: yes + +# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1. +num-threads: 1 + +# Ensure kernel buffer is large enough to not lose messages in traffic spikes +so-rcvbuf: 1m + +# Ensure privacy of local IP ranges +#private-address: 192.168.0.0/16 +#private-address: 169.254.0.0/16 +#private-address: 172.16.0.0/12 +#private-address: 10.0.0.0/8 +#private-address: fd00::/8 +#private-address:0.0.0.0/0 +access-control: 0.0.0.0/0 allow + +# Hide DNS Server info +#hide-identity: yes +#hide-version: yes + +# Add an unwanted reply threshold to clean the cache and avoid, when possible, DNS poisoning +#unwanted-reply-threshold: 10000000 + +# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes +# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details +use-caps-for-id: no + +# Perform prefetching of close to expired message cache entries +# This only applies to domains that have been frequently queried +#prefetch: yes +# Fetch the DNSKEYs earlier in the validation process, which lowers the latency of requests +# but also uses a little more CPU +#prefetch-key: yes