Unbound

What it's good for#

Every time a device on your network opens a website, it first asks a DNS server to turn the name into an address. Usually that's your internet provider's server, or a big public one, and whoever runs it sees every name every device asks for.

Unbound does the lookup itself. It starts at the internet's root servers and follows the chain down to the server responsible for each name, checking the answers' signatures (DNSSEC) on the way. No single company sees your whole list. It also remembers answers, so sites you visit often resolve instantly.

On its own it doesn't block anything. It's meant to sit behind Pi-hole or AdGuard Home: your devices ask the blocker, the blocker drops the adverts and trackers, and passes everything else to Unbound instead of to a public DNS service.

Connecting it to your blocker#

LibrePortal doesn't connect them for you yet, so it's one setting in the blocker. In both cases, Unbound's address is your server's own address on your network, with port 5335, for example 192.168.1.50 and 5335.

• AdGuard Home: in its own settings, under Settings → DNS settings → Upstream DNS servers, replace what's there with 192.168.1.50:5335, then press Test upstreams and Apply.
• Pi-hole: LibrePortal sets Pi-hole's upstream servers itself, which also means Pi-hole won't let you change them in its own settings. Change them through LibrePortal instead, where Pi-hole's config file setting takes the address with a # before the port:

sudo -u libreportal libreportal app install pihole 'CFG_PIHOLE_UPSTREAM_DNS=192.168.1.50#5335'

To check: confirm on a test box that Pi-hole and AdGuard reach Unbound at the server's LAN address on 5335 under rootless Docker, or whether the container address on LibrePortal's network is needed

Then check it's working: browse for a minute and look at the blocker's query log. The queries it forwards should now be answered by the upstream at port 5335.

Who can use it#

Unbound only answers private network addresses: your home network, LibrePortal's own apps, and devices on your VPN. It refuses everyone else, and its ports start private on top of that. An open DNS server on the internet gets used to attack other people within hours, so keep it that way.

You can point a single computer straight at it too, but most devices can't be told to use a port other than 53, which is another reason to put a blocker in front.

Good to know#

• Settings are LibrePortal's. LibrePortal adds a small file of its own to Unbound's standard setup, with the private-network rules, DNSSEC checking and a modest cache (it's sized for a small server, not a thousand users). Unbound's own defaults do the rest.
• The first lookups are a little slower. Asking the root servers is a few more steps than asking a big provider that already has the answer. After the cache warms up, it's quicker than going out to a provider every time.
• Metrics. With Prometheus and Grafana installed, Export metrics to Grafana in its settings adds a small exporter and a Grafana dashboard of queries and cache hits. To check: verify Unbound's metrics exporter works: it reads Unbound's remote-control port 8953, which LibrePortal's drop-in doesn't enable
• Updates are automatic, and it's included in backups, though there's little in it to lose.
• One per server, like any DNS server.