Konfigurasi Private DNS Server Menggunakan Unbound

Konfigurasi Private DNS Server Menggunakan Unbound. Oke di tutorial ini saya akan sharing sedikit bagaimana cara konfigurasi server DNS menggunakan Unbound. Kenapa saya memilih unbound dibanding bind9 adalah karena menurut saya pribadi untuk saat ini bind sudah terlalu usang, dan terlalu bloat juga bila dibanding dengan unbound.

Untuk konfigurasinya sendiri juga lebih simple dibanding dengan bind9.

Oke langsung saja ya ke tutorial. Disini saya menggunakan VPS Ubuntu yang akan digunakan sebagai private DNS server.

Install Unbound

Unbound sudah tersedia di repository Ubuntu dan bisa langsung diinstall menggunakan apt.

sudo apt update && sudo apt install unbound -y

Seluruh file konfigurasi Unbound berlokasi di /etc/unbound. Namun sebelum ke konfigurasi, kita mengunduh root-hints terlebih dahulu. File ini berisi list primary root DNS servers. Unbound sebenarnya memiliki list primary root DNS server dalam kodenya, tetapi kita ingin memastikan bahwa kita memiliki salinan terbarunya. Kalian bisa mengupdate file ini secara berkala. Misalnya, enam bulan sekali.

wget https://www.internic.net/domain/named.root -O /var/lib/unbound/root.hints

Konfigurasi Unbound

Selanjutnya kalian bisa edit file /etc/unbound/unbound.conf.

Berikut konfigurasi yang saya gunakan. Sesuaikan sendiri di beberapa parameter yang perlu diubah.

 

server:
# IP interface yang digunakan. Bisa dicek menggunakan command "ip addr".
    verbosity: 1
    interface: 192.168.1.1
    port: 53

# Mendefinisikan log unbound.
    logfile: /var/log/unbound.log
    log-queries: yes

# Enable or Disable
    do-ip4: yes
    do-ip6: no
    do-udp: yes
    do-tcp: yes

# Mengijinkan maupun memblokir client. Bisa menggunakan IP maupun subnet.
    access-control: 10.0.0.0/8 allow
    access-control: 127.0.0.0/8 allow
    access-control: 192.168.0.0/16 allow

# Mendefinisikan lokasi file root.hints
    root-hints: "/var/lib/unbound/root.hints"

# Memblokir query id.server, hostname.bind, version.server, version.bind.
    hide-identity: yes
    hide-version: yes

    harden-glue: yes
    harden-dnssec-stripped: yes

# https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
    use-caps-for-id: yes

# Caching 
    cache-min-ttl: 3600
    cache-max-ttl: 86400

# perform prefetching of close to expired message cache entries.
    prefetch: yes

# Threading. Sesuaikan dengan jumlah CPU. Bisa dicek menggunakan perintah "nproc".
    num-threads: 2

# Unbound tweaks
    msg-cache-slabs: 8
    rrset-cache-slabs: 8
    infra-cache-slabs: 8
    key-cache-slabs: 8
    
    rrset-cache-size: 256m
    msg-cache-size: 128m
    
    so-rcvbuf: 1m
# End of unbound tweak.


# Private address untuk menghindari DNS Rebinding. Hanya boleh digunakan oleh private-domain.
    private-address: 192.168.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8

# Private-domain
    private-domain: "linuxsec.lan"
    unwanted-reply-threshold: 10000
    do-not-query-localhost: no

#   auto-trust-anchor-file: "/var/lib/unbound/root.key"
    val-clean-additional: yes

# Memblokir Ads Server
    local-zone: "doubleclick.net" redirect
    local-data: "doubleclick.net A 127.0.0.1"
    local-zone: "googlesyndication.com" redirect
    local-data: "googlesyndication.com A 127.0.0.1"
    local-zone: "googleadservices.com" redirect
    local-data: "googleadservices.com A 127.0.0.1"
    local-zone: "google-analytics.com" redirect
    local-data: "google-analytics.com A 127.0.0.1"
    local-zone: "ads.youtube.com" redirect
    local-data: "ads.youtube.com A 127.0.0.1"
    local-zone: "adserver.yahoo.com" redirect
    local-data: "adserver.yahoo.com A 127.0.0.1"
    local-zone: "ask.com" redirect
    local-data: "ask.com A 127.0.0.1"

  #include: "/etc/unbound/unbound_ad_servers"

# Contoh zones di local network.
    local-zone: "linuxsec.lan." static

    local-data: "firewall.linuxsec.lan.  IN A 10.0.0.1"
    local-data-ptr: "10.0.0.1  firewall.linuxsec.lan"

  # Unbound can query your NSD or BIND server for private domain queries too.
  # On our NSD page we have NSD configured to serve the private domain,
  # "home.lan". Here we can tell Unbound to connect to the NSD server when it
  # needs to resolve a *.home.lan hostname or IP.
  #
  # private-domain: "home.lan"
  # local-zone: "0.0.10.in-addr.arpa." nodefault
  # stub-zone:
  #      name: "home.lan"
  #      stub-addr: 10.0.0.111@53

  # If you have an internal or private DNS names the external DNS servers can
  # not resolve, then you can assign domain name strings to be redirected to a
  # seperate dns server. For example, our comapny has the domain
  # organization.com and the domain name internal.organization.com can not be
  # resolved by Google's public DNS, but can be resolved by our private DNS
  # server located at 1.1.1.1. The following tells Unbound that any
  # organization.com domain, i.e. *.organization.com be dns resolved by 1.1.1.1
  # instead of the public dns servers.
  #
  # forward-zone:
  #    name: "organization.com"
  #    forward-addr: 1.1.1.1        # Internal or private DNS

  # Use the following forward-zone to forward all queries to Google DNS,
  # OpenDNS.com or your local ISP's dns servers for example. To test resolution
  # speeds use "drill calomel.org @8.8.8.8" and look for the "Query time:" in
  # milliseconds.
  #

# Query DNS akan diteruskan ke server berikut, dan jika gagal baru akan dikembalikan ke root DNS.  
  forward-zone:
    name: "."
    forward-addr: 1.1.1.1@53#one.one.one.one
    forward-addr: 8.8.8.8@53#dns.google
    forward-addr: 9.9.9.9@53#dns.quad9.net
    forward-addr: 1.0.0.1@53#one.one.one.one
    forward-addr: 8.8.4.4@53#dns.google
    forward-addr: 149.112.112.112@53#dns.quad9.net

# EOF

Selanjutnya, buat file log di direktori /var/log dan pastikan usernya adalah unbound.

sudo touch /var/log/unbound.log

sudo chown unbound: /var/log/unbound.log

Restart service Unbound dengan perintah

sudo service unbound restart

Untuk melihat status Unbound bisa gunakan perintah

unbound-control status

Untuk melihat log query yang dikirim ke Unbound, bisa cek di file /var/log/unbound.log.

Untuk mengatasi log yang bakal terus membengkak, kalian bisa gunakan logrotate. Berikut konfigurasi logrotate yang saya gunakan:

/var/log/unbound.log {
    su root root
    daily
    missingok
    rotate 10
    compress
    copytruncate
    notifempty
    create 0644 unbound unbound
    postrotate
        systemctl restart unbound
    endscript
}

Oke mungkin sekian dulu tutorial kali ini. Semoga bermanfaat. Jika ada yang ingin ditanyakan silahkan tinggalkan komentar.

Referensi:

https://calomel.org/unbound_dns.html