diff --git a/docs/guides/unbound.md b/docs/guides/unbound.md index 6a84aca..911fded 100644 --- a/docs/guides/unbound.md +++ b/docs/guides/unbound.md @@ -68,7 +68,7 @@ sudo mv root.hints /var/lib/unbound/ Highlights: -- Listen only for queries from the local Pi-hole installation (on port 5353) +- Listen only for queries from the local Pi-hole installation (on port 5335) - Listen for both UDP and TCP requests - Verify DNSSEC signatures, discarding BOGUS domains - Apply a few security and privacy tricks @@ -81,7 +81,8 @@ server: # logfile: "/var/log/unbound/unbound.log" verbosity: 0 - port: 5353 + interface: 127.0.0.1 + port: 5335 do-ip4: yes do-udp: yes do-tcp: yes @@ -89,6 +90,10 @@ server: # May be set to yes if you have IPv6 connectivity do-ip6: no + # You want to leave this to no unless you have *native* IPv6. With 6to4 and + # Terredo tunnels your web browser should favor IPv4 for the same reasons + prefer-ip6: no + # Use this only when you downloaded the list of primary root servers! root-hints: "/var/lib/unbound/root.hints" @@ -129,7 +134,7 @@ Start your local recursive server and test that it's operational: ```bash sudo service unbound start -dig pi-hole.net @127.0.0.1 -p 5353 +dig pi-hole.net @127.0.0.1 -p 5335 ``` The first query may be quite slow, but subsequent queries, also to other domains under the same TLD, should be fairly quick. @@ -139,8 +144,8 @@ The first query may be quite slow, but subsequent queries, also to other domains You can test DNSSEC validation using ```bash -dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5353 -dig sigok.verteiltesysteme.net @127.0.0.1 -p 5353 +dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335 +dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335 ``` The first command should give a status report of `SERVFAIL` and no IP address. The second should give `NOERROR` plus an IP address. @@ -149,6 +154,6 @@ The first command should give a status report of `SERVFAIL` and no IP address. T Finally, configure Pi-hole to use your recursive DNS server: -![screenshot at 2018-04-18](../images/RecursiveResolver.png) +![Upstream DNS Servers Configuration](../images/RecursiveResolver.png) (don't forget to hit Return or click on `Save`) diff --git a/docs/images/RecursiveResolver.png b/docs/images/RecursiveResolver.png index f2d4d00..c2a246f 100644 Binary files a/docs/images/RecursiveResolver.png and b/docs/images/RecursiveResolver.png differ