Adguard cache + Unbound

[whyisthisbroken]

Hi,

Would you consider to disable the cache and optimistic cache in Adguard Home when using unbound or leave it enabled ?
I've read that the devs from pihole recommend to let the cache on...

Is there any recommendations for Adguard Home? I don't find any informations...

Any ideas?

[up2you1]

anyone? im also looking for the answer to this, thanks

[up2you1]

Thank you, spent a few hours and got this working on a Pi4.

One question, when you point ADH to Unbound as the upstream server, do you use standard port 53? example 192.168.1.200:53 or do you use another port like 5353?

ive set mine to 5353 and also added 5353 into the unbound.conf file, which seems to work but the Pi it self loses DNS (although unbound and machines on the network resolve ok)

When its set to port 5353 and I do a "dig github.com" in ssh, it seems to want to resolve to 192.168.1.200#53 instead of 192.168.1.200:5353, where is it setting this #53 from?

Thanks again

[whyisthisbroken]

you should set upstream to local host ip - check with netstat -tulpn | grep unbound what IP Unbound is using.

The Upstream Server in AGH should be then:

127.0.0.1:53 
[::1]:53

or

0.0.0.0:53 
[::]:53

you could set it in the unbound.conf

This are mine Unbound Settings:

interface: 0.0.0.0
interface: ::0
do-ip4: yes
do-udp: yes
do-tcp: yes
do-ip6: yes
prefer-ip6: yes

AGH is bind to my RPi IPv4 and IPv6:

dns:
  bind_hosts:
    - IPv4 from my RPi (like 192.168.x.x)
    - IPv6 from my RPi (like fd00::xxxx:xx....)

[up2you1]

Thank you my friend

i forgot to say my AGH is on another device than the Pi that has Unbound/Redis on it, hence why i have to use the IP of the Pi in AGH upstream server, i think i have sort it now, i had to install dhcpcd5 and now the Pi has dns it self for updates etc

So far so good! ive just done the dashboard too, looks amazing!

one last question, with unbound in opnsense (Web Gui based), i was able to choose Quad9 as DNS server for DoT, which hid my ISP DNS when using leak test sites like www.dnsleaktest.com

I know this implementation of Unbound has DNSSec enabled but it doesnt hide my ISPs DNS server

Can i add these in this implementation of Unbound has DNSSec ?

[whyisthisbroken]

Here are my forwarding settings:

server:
tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
forward-zone:
name: "."
forward-tls-upstream: yes

# Quad9(Standard)
forward-addr: 9.9.9.9@853#dns.quad9.net
forward-addr: 149.112.112.112@853#dns.quad9.net
forward-addr: 149.112.112.9@853#dns.quad9.net
forward-addr: 2620:fe::fe:9@853#dns.quad9.net
forward-addr: 2620:fe::fe@853#dns.quad9.net
forward-addr: 2620:fe::9@853#dns.quad9.net

You need to follow this instruction if not already done:
https://nlnetlabs.nl/documentation/unbound/howto-anchor/

My hole Unbound Settings can you find here:
https://pastebin.com/YXSSB5bG

In AGH you should also set under DNS Settings "Enable DNSSEC"

I´ve got no leaks with this settings. Hope it helps.

QNAME Min Test with:
dig +short TXT whoami.ds.akahelp.net && dig +short TXT qnamemintest.internet.nl

DNSSEC Test:

dig @192.168.1.200 fail01.dnssec.works 
dig @192.168.1.200 dnssec.works

[up2you1]

Awesome! thank you so much,

I already did the anchor as the initial set up was missing the root.key file

but added the forward-addr: and we now working.

the command for me were:

dig @192.168.1.200 -p5353 fail01.dnssec.works
dig @192.168.1.200 -p5353 dnssec.works

and both came back with a result.

Thanks again for your help, its been a slog but got their in the end

im also using dietpi and there were quite a few missing packages that needed to be installed when following the unbound-redis guide, i may try to write it up incase the Pi needs to be rebuilt.

[mikeinanaheim]

I've got Dietpi with Unbound installed thru Dietpi software. What am I missing to get "command not found"?
Thanks.

root@pi4b:~# dig @192.168.1.200 dnssec.works
-bash: dig: command not found

[whyisthisbroken]

You must install dnsutils:

sudo apt-get install dnsutils

Then you should be able to use the dig command.

[mikeinanaheim]

Thank you, appreciated. Works well.
I'd (stupidly) assumed dig capability was already part of the OS.