Unbound DNS over TLS Adblock up-to-date root.hints

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Goto page Previous  1, 2, 3, 4, 5  Next
Author Message
PavelVD
DD-WRT User


Joined: 26 Jul 2019
Posts: 109

PostPosted: Wed Sep 25, 2019 13:36    Post subject: Reply with quote
Great news!
So in r41135 is this already included?
And I looked about errors here: https://github.com/NLnetLabs/unbound/issues
And Changelog is here: https://github.com/NLnetLabs/unbound/blob/release-1.9.3/doc/Changelog

_________________
Linksys WRT1900ACSv2
Automatically adjustable temperature, always within the range of 59-68°С.
Sponsor
PavelVD
DD-WRT User


Joined: 26 Jul 2019
Posts: 109

PostPosted: Wed Sep 25, 2019 19:32    Post subject: Reply with quote
I tried 1.9.3 wired now in dd-wrt ... disappointment.
I can not get the elementary log file. It seems that everything you need is included:
Code:
logfile: "/jffs/unbound/unbound.log"
verbosity: 1 (tried from 1 to 6)
use-syslog: no
log-identity: ""

How can I check the operation of other options if the log does not work?
Has anyone managed to turn it on?

At the expense of raspberries - this is a good idea, I have been thinking about it for a long time. I have available orange_pi_pc+; maybe you can install a full Unbound on it? While it serves for other purposes.

_________________
Linksys WRT1900ACSv2
Automatically adjustable temperature, always within the range of 59-68°С.
tinkeruntilitworks
Guest





PostPosted: Mon Dec 02, 2019 0:30    Post subject: Reply with quote
any other Unbound users out there?
how does this look?
PavelVD
DD-WRT User


Joined: 26 Jul 2019
Posts: 109

PostPosted: Mon Dec 02, 2019 19:00    Post subject: Reply with quote
I made several more attempts to switch to Unbound, but returned to DNSCrypt2 again.

When Unbound starts, the cache is still empty and the first requests are processed for a very long time. If you just go on the Internet pages, then such delays can be tolerated. But there are several TV boxes on my network that fail, they need faster responses. Another nuisance: after a long downtime (night, for example), the cache is empty again, and it seems that there is simply no Internet. The "prefetch: yes" parameter in the settings file does not seem to correct this situation.


Please note that the file "named.cache" from the firmware is hopelessly outdated.

Attempts to use Unbound on orange_pi_pc_plus also failed due to the lack of fresh versions - poor support in Armbian.

_________________
Linksys WRT1900ACSv2
Automatically adjustable temperature, always within the range of 59-68°С.
tinkeruntilitworks
Guest





PostPosted: Mon Dec 02, 2019 20:08    Post subject: Reply with quote
sounds like you're far better off with dnscrypt

*
yeah the named.cache in the default directory is out-of-date. one of the steps is downloading a new one in the new directory
tatsuya46
DD-WRT Guru


Joined: 03 Jan 2010
Posts: 7568
Location: YWG, Canada

PostPosted: Wed Apr 08, 2020 11:32    Post subject: Reply with quote
changing

root-hints: "/etc/unbound/named.cache"

to anything, but the default in quotes makes unbound not start.. not even changing it to the /usr/local/etc/ path the custom unbound conf is in. i cant tell if its actually using it, or the ancient default one. i did manually put a up to date named.cache in there anyway.

i also have this in conf:

auth-zone:
name: "."
master: 199.7.91.13 # d.root-servers.net
master: 192.203.230.10 # e.root-servers.net
master: 192.5.5.241 # f.root-servers.net
master: 192.58.128.30 # j.root-servers.net
fallback-enabled: yes
for-downstream: no
for-upstream: yes
zonefile: "root.zone"

in attempt to use the whole root.zone locally, it does download it to /tmp on start, but again cant tell if its using it.. lookup times seem the same.

_________________
LATEST FIRMWARE(S)

BrainSlayer wrote:
we just do it since we do not like any restrictions enforced by stupid cocaine snorting managers

[x86_64] Haswell i3-4150/QCA9984/QCA9882 ------> r55797 std
[QUALCOMM] DIR-862L --------------------------------> r55797 std
▲ ACTIVE / INACTIVE ▼
[QUALCOMM] WNDR4300 v1 --------------------------> r50485 std
[BROADCOM] DIR-860L A1 ----------------------------> r50485 std


Sigh.. why do i exist anyway.. | I love you Anthony.. never forget that.. my other 99% that ill never see again..

tinkeruntilitworks
Guest





PostPosted: Thu Apr 09, 2020 14:32    Post subject: Reply with quote
i have limited knowledge and i'm not familiar with your setup

i'm not certain if everything gets implemented in my setup either. it runs well for me but according to the documentation some changes are dependent on how it was installed
Redback813
DD-WRT Novice


Joined: 10 Nov 2015
Posts: 43

PostPosted: Thu Apr 23, 2020 21:26    Post subject: Reply with quote
I can start the unbound in the setup of DD-WRT but for the life of me I can not find any info on how to use the custom setting of unbound from /jffs/unbound as oppose to the default setting, at present I using dnsmasq with great result but wish to play with unbound to see what it can do, any idea people on how to get the custom setting up running.
tatsuya46
DD-WRT Guru


Joined: 03 Jan 2010
Posts: 7568
Location: YWG, Canada

PostPosted: Fri Apr 24, 2020 10:42    Post subject: Reply with quote
this is my current conf for reference.. recursion, no dnssec. still trying to understand some things like target-fetch-policy, auth zone, and why root hints cant be changed etc.

Code:

server:
verbosity: 1
interface: 0.0.0.0
outgoing-num-tcp: 15
incoming-num-tcp: 15
msg-buffer-size: 65552
outgoing-range: 4096
num-queries-per-thread: 2048
so-rcvbuf: 5m
so-sndbuf: 5m
key-cache-size: 8m
neg-cache-size: 2m
msg-cache-size: 128m
rrset-cache-size: 256m
rrset-roundrobin: yes
cache-min-ttl: 3600
infra-host-ttl: 259200
infra-cache-numhosts: 100000
serve-expired: yes
username: ""
pidfile: "/var/run/unbound.pid"
root-hints: "/etc/unbound/named.cache"
auto-trust-anchor-file: ""
prefetch: yes
prefetch-key: yes
target-fetch-policy: "-1 -1 -1 -1 -1"
harden-short-bufsize: no
harden-large-queries: no
minimal-responses: no
so-reuseport: yes
num-threads: 4
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
port: 7053
do-ip4: yes
do-ip6: no
do-udp: yes
do-tcp: yes
access-control: 127.0.0.0/8 allow
access-control: 10.150.10.0/24 allow
access-control: 0.0.0.0/0 refuse
local-data: "localhost A 127.0.0.1"
auth-zone:
name: "."
master: 199.7.91.13          # d.root-servers.net
master: 192.203.230.10       # e.root-servers.net
master: 192.5.5.241          # f.root-servers.net
master: 192.58.128.30        # j.root-servers.net
fallback-enabled: yes
for-downstream: no
for-upstream: yes
zonefile: root.zone
python:
remote-control:


running on a x86 with 4gb ram so adjust accordingly for a weak arm router etc..

_________________
LATEST FIRMWARE(S)

BrainSlayer wrote:
we just do it since we do not like any restrictions enforced by stupid cocaine snorting managers

[x86_64] Haswell i3-4150/QCA9984/QCA9882 ------> r55797 std
[QUALCOMM] DIR-862L --------------------------------> r55797 std
▲ ACTIVE / INACTIVE ▼
[QUALCOMM] WNDR4300 v1 --------------------------> r50485 std
[BROADCOM] DIR-860L A1 ----------------------------> r50485 std


Sigh.. why do i exist anyway.. | I love you Anthony.. never forget that.. my other 99% that ill never see again..

tinkeruntilitworks
Guest





PostPosted: Fri Apr 24, 2020 12:48    Post subject: Reply with quote
did you try creating the new unbound directory?
that way the root.hints would be up-to-date.
then add the directory and files to the unbound.conf
chroot: "/jffs/unbound"
directory: "/jffs/unbound"
root-hints: "/jffs/unbound/root.hints"
auto-trust-anchor-file: "/jffs/unbound/root.key"


Last edited by tinkeruntilitworks on Tue Jun 23, 2020 16:29; edited 1 time in total
tatsuya46
DD-WRT Guru


Joined: 03 Jan 2010
Posts: 7568
Location: YWG, Canada

PostPosted: Fri Apr 24, 2020 13:23    Post subject: Reply with quote
tinkeruntilitworks wrote:
tatsuya46 wrote:
this is my current conf for reference.. recursion, no dnssec. still trying to understand some things like target-fetch-policy, auth zone, and why root hints cant be changed etc.

Code:

server:
verbosity: 1
interface: 0.0.0.0
outgoing-num-tcp: 15
incoming-num-tcp: 15
msg-buffer-size: 65552
outgoing-range: 4096
num-queries-per-thread: 2048
so-rcvbuf: 5m
so-sndbuf: 5m
key-cache-size: 8m
neg-cache-size: 2m
msg-cache-size: 128m
rrset-cache-size: 256m
rrset-roundrobin: yes
cache-min-ttl: 3600
infra-host-ttl: 259200
infra-cache-numhosts: 100000
serve-expired: yes
username: ""
pidfile: "/var/run/unbound.pid"
root-hints: "/etc/unbound/named.cache"
auto-trust-anchor-file: ""
prefetch: yes
prefetch-key: yes
target-fetch-policy: "-1 -1 -1 -1 -1"
harden-short-bufsize: no
harden-large-queries: no
minimal-responses: no
so-reuseport: yes
num-threads: 4
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
port: 7053
do-ip4: yes
do-ip6: no
do-udp: yes
do-tcp: yes
access-control: 127.0.0.0/8 allow
access-control: 10.150.10.0/24 allow
access-control: 0.0.0.0/0 refuse
local-data: "localhost A 127.0.0.1"
auth-zone:
name: "."
master: 199.7.91.13          # d.root-servers.net
master: 192.203.230.10       # e.root-servers.net
master: 192.5.5.241          # f.root-servers.net
master: 192.58.128.30        # j.root-servers.net
fallback-enabled: yes
for-downstream: no
for-upstream: yes
zonefile: root.zone
python:
remote-control:


running on a x86 with 4gb ram so adjust accordingly for a weak arm router etc..


did you try creating the new unbound directory?
that way the root.hints would be up-to-date.
then add the directory and files to the unbound.conf
chroot: "/jffs/unbound"
directory: "/jffs/unbound"
root-hints: "/jffs/unbound/root.hints"
auto-trust-anchor-file: "/jffs/unbound/root.key"


i dont understand chroot purpose, everytime i tried anything with it unbound always dont start. ill try it that way later.

_________________
LATEST FIRMWARE(S)

BrainSlayer wrote:
we just do it since we do not like any restrictions enforced by stupid cocaine snorting managers

[x86_64] Haswell i3-4150/QCA9984/QCA9882 ------> r55797 std
[QUALCOMM] DIR-862L --------------------------------> r55797 std
▲ ACTIVE / INACTIVE ▼
[QUALCOMM] WNDR4300 v1 --------------------------> r50485 std
[BROADCOM] DIR-860L A1 ----------------------------> r50485 std


Sigh.. why do i exist anyway.. | I love you Anthony.. never forget that.. my other 99% that ill never see again..

tinkeruntilitworks
Guest





PostPosted: Fri Apr 24, 2020 13:38    Post subject: Reply with quote
i include the chroot setting because in the default settings it uses chroot to the temp directory where the default router conf is created

maybe
chroot: ""

would be better?
tatsuya46
DD-WRT Guru


Joined: 03 Jan 2010
Posts: 7568
Location: YWG, Canada

PostPosted: Fri Apr 24, 2020 17:48    Post subject: Reply with quote
tinkeruntilitworks wrote:
i include the chroot setting because in the default settings it uses chroot to the temp directory where the default router conf is created

maybe
chroot: ""

would be better?


the first suggestion worked

chroot: "/jffs/etc"
directory: "/jffs/etc"
root-hints: "/jffs/etc/named.cache"
auto-trust-anchor-file: "/jffs/etc/root.key"


and it started.

_________________
LATEST FIRMWARE(S)

BrainSlayer wrote:
we just do it since we do not like any restrictions enforced by stupid cocaine snorting managers

[x86_64] Haswell i3-4150/QCA9984/QCA9882 ------> r55797 std
[QUALCOMM] DIR-862L --------------------------------> r55797 std
▲ ACTIVE / INACTIVE ▼
[QUALCOMM] WNDR4300 v1 --------------------------> r50485 std
[BROADCOM] DIR-860L A1 ----------------------------> r50485 std


Sigh.. why do i exist anyway.. | I love you Anthony.. never forget that.. my other 99% that ill never see again..

Redback813
DD-WRT Novice


Joined: 10 Nov 2015
Posts: 43

PostPosted: Sun Apr 26, 2020 7:55    Post subject: Reply with quote
Still can't get unbound to work with the custom setting, I'm running DD-WRT v3.0-r42954 std (04/20/20) I know for sure that samba has a serious issue of dropouts, so this would not surprise me if unbound is having issue also. Here is the setting, I'll be dammed if I can get this to work but the default setting is not a problem.

server:
verbosity: 1
interface: 0.0.0.0@7053
interface: ::0@7053
outgoing-num-tcp: 10
incoming-num-tcp: 10
msg-buffer-size: 8192
msg-cache-size: 50m
num-queries-per-thread: 30
rrset-cache-size: 100m
infra-cache-numhosts: 200
username: ""
pidfile: "/var/run/unbound.pid"
root-hints: "/jffs/unbound/named.cache"
chroot: "/jffs/unbound"
directory: "/jffs/unbound"
include: "/jffs/unbound/conf.d/*.conf"
target-fetch-policy: "2 1 0 0 0 0"
harden-short-bufsize: yes
harden-large-queries: yes
auto-trust-anchor-file: "/jffs/unbound/root.key"
key-cache-size: 100k
neg-cache-size: 10k
num-threads: 2
so-rcvbuf: 1m
so-sndbuf: 1m
so-reuseport: yes
msg-cache-slabs: 2
rrset-cache-slabs: 2
infra-cache-slabs: 2
key-cache-slabs: 2
outgoing-range: 462
access-control: 127.0.0.0/8 allow
access-control: 10.10.10.0/24 allow
local-data: "localhost A 127.0.0.1"
python:
remote-control:
forward-zone:
name: "."
forward-tls-upstream: yes
forward-addr: 209.222.18.218@853#Privateinternetaccess-dns.com
forward-addr: 209.222.18.222@853#Privateinternetaccess-dns.com
forward-addr: 1.0.0.1@853#cloudflare-dns.com
forward-addr: 1.1.1.1@853#cloudflare-dns.com
tinkeruntilitworks
Guest





PostPosted: Sun Apr 26, 2020 11:44    Post subject: Reply with quote
unbound does dns over tls using tcp only. possibly the issue?

i'm not familiar with the private internet access dns or your include conf

hopefully someone that has mixed a vpn and unbound see this so they could help
Goto page Previous  1, 2, 3, 4, 5  Next Display posts from previous:    Page 2 of 5
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum