Unbound cache-only DNS server setup on RHEL 7 Linux

by

Introduction

Unbound is a validating, recursive, and caching DNS server. Having said that, Unbound DNS server cannot be used as an authoritative DNS server, which means it cannot be used to host custom domain name records. As a result, if your goal is to build a cache-only or forwarding DNS server, Unbound may be your preferred choice, as it does just that and it does it well.

Objective

The objective is to provide quick and easy to follow installation and configuration guide for the Unbound cache-only DNS server on Redhat 7 Linux. At the end of this guide you will be able to use Unbound DNS server from all clients on your local area network.

Requirements

Privileged access to your Redhat 7 Linux server with configured standard RedHat repositories.

Difficulty

MEDIUM

Conventions

  • # – requires given linux commands to be executed with root privileges either directly as a root user or by use of sudo command
  • $ – requires given linux commands to be executed as a regular non-privileged user

Instructions

Unbound and DNS tools installation

In the first step we are going to install the actual Unbound DNS server as well as DNS tools which will be eventually used to test your DNS cache-only server configuration. Given that you have your Redhat repository configured correctly you can install both by executing the following linux command:

# yum install unbound bind-utils

Basic Unbound Configuration

Now, we are going to perform a basic configuration of the Unbound DNS caching-only server. This will be done by editing Unbound’s configuration file /etc/unbound/unbound.conf either by using text editor or using a below sed commands. First, use your preferred text editor to locate the line # interface: 0.0.0.0 and uncomment it by removing the leading # sign. Alternatively use the below sed command:

# sed -i '/interface: 0.0.0.0$/s/#//' /etc/unbound/unbound.conf

The above configuration will instruct Unbound DNS server to listen on all local network interfaces. Next, allow your LAN clients to query Unbound’s cache. Locate the relevant line change the default loopback IP address 127.0.0.0/8 to netowork address of your LAN eg. 10.0.0.0/24:

FROM:
access-control: 127.0.0.0/8 allow
TO
access-control: 10.0.0.0/24 allow

The above can also be done by sed command:

# sed -i 's/127.0.0.0\/8 allow/10.0.0.0\/24 allow/' /etc/unbound/unbound.conf

Setup DNSSEC support

Next, we instruct Unbound DNS server to generate RSA keys in order to provide DNSSEC support:

# unbound-control-setup 
setup in directory /etc/unbound
generating unbound_server.key
Generating RSA private key, 1536 bit long modulus
.................++++
.........++++
e is 65537 (0x10001)
generating unbound_control.key
Generating RSA private key, 1536 bit long modulus
.........++++
..................................++++
e is 65537 (0x10001)
create unbound_server.pem (self signed certificate)
create unbound_control.pem (signed client certificate)
Signature ok
subject=/CN=unbound-control
Getting CA Private Key
Setup success. Certificates created. Enable in unbound.conf file to use

All what remains is to check Unbound’s configuration:

# unbound-checkconf
unbound-checkconf: no errors in /etc/unbound/unbound.conf

Enable and start Unbound server

At this stage we will enable Unbound DNS server to start at the boot time:

# systemctl enable unbound
Created symlink from /etc/systemd/system/multi-user.target.wants/unbound.service to /usr/lib/systemd/system/unbound.service.

and start the actual service:

# service unbound start
Redirecting to /bin/systemctl start  unbound.service

Make sure that Unbound DNS server is running by checking its status:

[root@localhost unbound]# service unbound status
Redirecting to /bin/systemctl status  unbound.service
● unbound.service - Unbound recursive Domain Name Server
   Loaded: loaded (/usr/lib/systemd/system/unbound.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2016-12-07 10:32:58 AEDT; 6s ago
  Process: 2355 ExecStartPre=/usr/sbin/unbound-anchor -a /var/lib/unbound/root.key -c /etc/unbound/icannbundle.pem (code=exited, status=0/SUCCESS)
  Process: 2353 ExecStartPre=/usr/sbin/unbound-checkconf (code=exited, status=0/SUCCESS)
 Main PID: 2357 (unbound)
   CGroup: /system.slice/unbound.service
           └─2357 /usr/sbin/unbound -d

Dec 07 10:32:57 localhost.localdomain systemd[1]: Starting Unbound recursive Domain Name Server...
Dec 07 10:32:57 localhost.localdomain unbound-checkconf[2353]: unbound-checkconf: no errors in /etc/unbound/unbound.conf
Dec 07 10:32:58 localhost.localdomain systemd[1]: Started Unbound recursive Domain Name Server.
Dec 07 10:32:58 localhost.localdomain unbound[2357]: Dec 07 10:32:58 unbound[2357:0] warning: increased limit(open files) from 1024 to 8266
Dec 07 10:32:58 localhost.localdomain unbound[2357]: [2357:0] notice: init module 0: validator
Dec 07 10:32:58 localhost.localdomain unbound[2357]: [2357:0] notice: init module 1: iterator
Dec 07 10:32:58 localhost.localdomain unbound[2357]: [2357:0] info: start of service (unbound 1.4.20).

Open DNS firewall port

To allow your local LAN clients to connect to your new Unbound cache-only DNS server you’ll need to open a DNS port:

# firewall-cmd --permanent --add-service dns
success
# firewall-cmd --reload
success

All done, we are now ready for testing.

Testing

Finally, we have come to a point where we can perform some basic testing of our new Unbound DNS cache-only server. For this we use dig command which a a part of previously installed bind-utils package to perform some DNS queries. First, execute DNS query on the actual DNS server:

# dig @localhost example.com

; <<>> DiG 9.9.4-RedHat-9.9.4-37.el7 <<>> @localhost example.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53485
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;example.com.                   IN      A

;; ANSWER SECTION:
example.com.            86400   IN      A       93.184.216.34

;; Query time: 817 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Dec 07 10:40:46 AEDT 2016
;; MSG SIZE  rcvd: 56

Note, that the query time is more that 817 msec. Since we have configured DNS cache-only server this query is now cached so any subsequent DNS query resolution of that same domain name we be rather instant:

# dig @localhost example.com

; <<>> DiG 9.9.4-RedHat-9.9.4-37.el7 <<>> @localhost example.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34443
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;example.com.                   IN      A

;; ANSWER SECTION:
example.com.            86272   IN      A       93.184.216.34

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Dec 07 10:42:54 AEDT 2016
;; MSG SIZE  rcvd: 56

Lastly, you may now test Ubound DNS server's configuration from your local LAN clients by pointing them to Unbound's IP address eg. 10.1.1.45:

$ dig @10.1.1.45 example.com

; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> @10.1.1.45 example.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 50494
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; Query time: 0 msec
;; SERVER: 10.1.1.45#53(10.1.1.45)
;; WHEN: Wed Dec 07 10:45:43 AEDT 2016
;; MSG SIZE  rcvd: 12

Related Linux Tutorials: