LILiK
/
openwrt-packages-dist
5
0
Fork 0
Code Issues 0 Pull Requests 0 Projects 0 Releases 0 Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
10343 Commits
1 Branch
46 MiB
Tree: 7962bfd3df
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '7962bfd3df'
${ noResults }
openwrt-packages-dist/net/unbound/files/unbound.uci

35 lines
910 B
Raw Normal View History

Unbound: Add UCI primer files -README.md to describe the UCI in detail -unbound.uci to get you started Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
unbound: add option for dhcp UCI domain mx srv and cname Base LEDE/OpenWrt UCI for dnsmasq provides for DNS override in /etc/config/dhcp. It is desired to be able to use dnsmasq and Unbound as transparently as possible. Option 'add_extra_dns' will pull 'domain', 'mxhost', 'srvhost, and 'cname' from base. netifd/procd have an interaction with DHCPv6/RA on WAN (FS#713). Minor IP6 parameter updates can cause Unbound reload events every few minutes. List option 'trigger' selects which interfaces may cause reload. For example 'lan', 'wan' but not 'wan6'. Squash other cosmetics. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
unbound: expand UCI to cover some popular dnsmasq features Unbound+DHCP (server of your choice) should be able to replicate a lot of what dnsmasq provides. With this change set Unbound still works with dnsmasq, but also it can work with a plain DHCP server. Features have been added within the UCI itself to act like dnsmasq. - alone: name each interface relative to router hostname - alone: prevent upstream leakage of your domain and '.local' - dnsmasq: use dnsmasq UCI to configure forwarding clauses - dhcp: work with odhcpd as example of companion DHCP-DNS - dhcp: convert DHCPv4 leases into EUI64 SLAAC for DNS records - all: enable encrypted remote unbound-control using splice conf - all: allow user spliced conf-files for hybrid UCI and manual conf -- 'unbound_srv.conf' will be spliced into the 'server:' clause -- 'unbound_ext.conf' will add clauses to the end, example 'forward:' README HOW TO for dnsmasq-in-serial, dnsmasq-in-parallel, and unbound-with-odhcpd have better/added UCI starters. HOW TO for including unbound_srv.conf and unbound_ext.conf are added. Document new UCI: add_local_fqdn, add_wan_fqdn, dhcp4_slaac6, dhcp_link, domain, and domain_type Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
​
​
​
Unbound: added UCI support for DNS64 Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com> Signed-off-by: Dan Luedte <mail@danrl.com>
8 years ago
​
unbound: expand UCI to cover some popular dnsmasq features Unbound+DHCP (server of your choice) should be able to replicate a lot of what dnsmasq provides. With this change set Unbound still works with dnsmasq, but also it can work with a plain DHCP server. Features have been added within the UCI itself to act like dnsmasq. - alone: name each interface relative to router hostname - alone: prevent upstream leakage of your domain and '.local' - dnsmasq: use dnsmasq UCI to configure forwarding clauses - dhcp: work with odhcpd as example of companion DHCP-DNS - dhcp: convert DHCPv4 leases into EUI64 SLAAC for DNS records - all: enable encrypted remote unbound-control using splice conf - all: allow user spliced conf-files for hybrid UCI and manual conf -- 'unbound_srv.conf' will be spliced into the 'server:' clause -- 'unbound_ext.conf' will add clauses to the end, example 'forward:' README HOW TO for dnsmasq-in-serial, dnsmasq-in-parallel, and unbound-with-odhcpd have better/added UCI starters. HOW TO for including unbound_srv.conf and unbound_ext.conf are added. Document new UCI: add_local_fqdn, add_wan_fqdn, dhcp4_slaac6, dhcp_link, domain, and domain_type Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
​
Unbound: Add UCI primer files -README.md to describe the UCI in detail -unbound.uci to get you started Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
unbound: update options for remote-control Enhance the 'control' option to allow using SSL to connect to the server. Add the 'extended_stats' option to match 'extended-statistics: yes.' Document the 'extended_luci' option; it does not control Unbound, but changes the LuCI tabs. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
7 years ago
​
unbound: UCI updates to take advantage of 1.6.0 - UCI to take advantage of "qname-minimisation-strict:" - UCI to block chaos reponses bind, server, and version - UCI to limit or prefer recrusion over IP4 or IP6 Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
Unbound: Add UCI primer files -README.md to describe the UCI in detail -unbound.uci to get you started Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
​
​
unbound: UCI updates to take advantage of 1.6.0 - UCI to take advantage of "qname-minimisation-strict:" - UCI to block chaos reponses bind, server, and version - UCI to limit or prefer recrusion over IP4 or IP6 Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
Unbound: Add UCI primer files -README.md to describe the UCI in detail -unbound.uci to get you started Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
unbound: UCI updates to take advantage of 1.6.0 - UCI to take advantage of "qname-minimisation-strict:" - UCI to block chaos reponses bind, server, and version - UCI to limit or prefer recrusion over IP4 or IP6 Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
Unbound: Add UCI primer files -README.md to describe the UCI in detail -unbound.uci to get you started Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
​
​
​
unbound: improve maintenance of trust anchor Unbound UCI tries to protect embedded flash from excess use. Unbound RFC5011 KSK tracking can rewrite root.key every few minutes to an hour. It also writes and destroys files in the same directory during the process. Recommended UCI delays for copying busy work in /var/ back to /etc/ may be too conservative. These are all changed from 28 to 9 days. The RFC5011 KSK results were also destroyed by an init.d restart, even if /var/ is mounted on persistent storage like USB drive. /var/lib/unbound/root.key is now preserved during this process, unless a newer key is installed in /etc/ manually or package update. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
Unbound: Add UCI primer files -README.md to describe the UCI in detail -unbound.uci to get you started Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
​
​
​
unbound: add domain resolution control options - Add domain_forward to permit designated domains to forward instead of recurse as listed in resolve.conf.auto from DHCP WAN client - Update rebind_protection and add rebind_interface to protect IP6 GLA locally just like RFC 1918 protection - Rename trigger to trigger_interface with backwards compatability - Update odhcpd script for efficiency handling many clients Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
7 years ago
​
​
​
​
Unbound: Add UCI primer files -README.md to describe the UCI in detail -unbound.uci to get you started Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
8 years ago
 
  1. config unbound
  2. 	option add_extra_dns '0'
  3. 	option add_local_fqdn '1'
  4. 	option add_wan_fqdn '0'
  5. 	option dhcp_link 'none'
  6. 	option dhcp4_slaac6 '0'
  7. 	option dns64 '0'
  8. 	option dns64_prefix '64:ff9b::/96'
  9. 	option domain 'lan'
  10. 	option domain_type 'static'
  11. 	option edns_size '1280'
  12. 	option extended_luci '0'
  13. 	option extended_stats '0'
  14. 	option hide_binddata '1'
  15. 	option listen_port '53'
  16. 	option localservice '1'
  17. 	option manual_conf '0'
  18. 	option protocol 'mixed'
  19. 	option query_minimize '0'
  20. 	option query_min_strict '0'
  21. 	option rebind_localhost '0'
  22. 	option rebind_protection '1'
  23. 	option recursion 'passive'
  24. 	option resource 'small'
  25. 	option root_age '9'
  26. 	option ttl_min '120'
  27. 	option unbound_control '0'
  28. 	option validator '0'
  29. 	option validator_ntp '1'
  30. 	list trigger_interface 'lan'
  31. 	list trigger_interface 'wan'
  32. 	#list rebind_interface 'lan'
  33. 	#list domain_insecure 'ntp.example.com'
  34. 	#list domain_forward 'mail.example.com'
  35.