Update unbound.md

* Listen on 127.0.0.1 so that clients cannot bypass pi.hole DNS by
  querying the resolver directly (Useful if external DNS queries are only
  allowed from trusted sources on the router)
* Use a different port, avahi-daemon may be using 5353 already
* Add/document prefer-ip6 param which may be very useful in conjunction
  with do-ip6

docs/guides/unbound.md

@@ -68,7 +68,7 @@ sudo mv root.hints /var/lib/unbound/
 
 Highlights:
 
-- Listen only for queries from the local Pi-hole installation (on port 5353)
+- Listen only for queries from the local Pi-hole installation (on port 5335)
 - Listen for both UDP and TCP requests
 - Verify DNSSEC signatures, discarding BOGUS domains
 - Apply a few security and privacy tricks
@@ -81,7 +81,8 @@ server:
     # logfile: "/var/log/unbound/unbound.log"
     verbosity: 0
 
-    port: 5353
+    interface: 127.0.0.1
+    port: 5335
     do-ip4: yes
     do-udp: yes
     do-tcp: yes
@@ -89,6 +90,10 @@ server:
     # May be set to yes if you have IPv6 connectivity
     do-ip6: no
 
+    # You want to leave this to no unless you have *native* IPv6. With 6to4 and
+    # Terredo tunnels your web browser should favor IPv4 for the same reasons
+    prefer-ip6: no
+
     # Use this only when you downloaded the list of primary root servers!
     root-hints: "/var/lib/unbound/root.hints"
 
@@ -129,7 +134,7 @@ Start your local recursive server and test that it's operational:
 
 ```bash
 sudo service unbound start
-dig pi-hole.net @127.0.0.1 -p 5353
+dig pi-hole.net @127.0.0.1 -p 5335
 ```
 
 The first query may be quite slow, but subsequent queries, also to other domains under the same TLD, should be fairly quick.
@@ -139,8 +144,8 @@ The first query may be quite slow, but subsequent queries, also to other domains
 You can test DNSSEC validation using
 
 ```bash
-dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5353
-dig sigok.verteiltesysteme.net @127.0.0.1 -p 5353
+dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335
+dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335
 ```
 
 The first command should give a status report of `SERVFAIL` and no IP address. The second should give `NOERROR` plus an IP address.
@@ -149,6 +154,6 @@ The first command should give a status report of `SERVFAIL` and no IP address. T
 
 Finally, configure Pi-hole to use your recursive DNS server:
 
-![screenshot at 2018-04-18](../images/RecursiveResolver.png)
+![Upstream DNS Servers Configuration](../images/RecursiveResolver.png)
 
 (don't forget to hit Return or click on `Save`)