← Back to DNS

Setting Up a Recursive Resolver on OpenBSD

OpenBSD is a variant of Unix known for security and a focus on code correctness. It also comes bundled with a high performance caching, validating, recursive DNS resolver package called Unbound. Unbound is easily configured, we will give an example of doing so here.

Configuring the unbound server

The first step is to configure the server by editing its configuration file, /var/unbound/etc/unbound.conf. The format and allowable settings in this file are given in the man page, unbound.conf(5), but at a high level it contains several sections:

A server: section allows us to set settings for the server itself.
A remote-control: section lets setup access for a control client.
An arbitrary number of optional zone-specific sections that allow us to configure options for those zones. This gives us the ability to forward to specific authoritative servers for a zone and so on.

Here's an example of what a configuration file might look like:

server:
        interface: 0.0.0.0
        interface: ::0

        access-control: 0.0.0.0/0 refuse
        access-control: ::0/0 refuse

        access-control: 127.0.0.0/8 allow
        access-control: ::1 allow

        access-control: 44.0.0.0/9 allow
        access-control: 44.128.0.0/10 allow

        hide-identity: yes
        hide-version: yes

        # Perform DNSSEC validation.
        auto-trust-anchor-file: "/var/unbound/db/root.key"
        val-log-level: 2

        # Synthesize NXDOMAINs from DNSSEC NSEC chains.
        # https://tools.ietf.org/html/rfc8198
        #
        aggressive-nsec: yes

        # Use TCP for "forward-zone" requests. Useful if you are making
        # DNS requests over an SSH port forwarding.
        #tcp-upstream: yes

        # CA Certificates used for forward-tls-upstream (RFC7858) hostname
        # verification.  Since it's outside the chroot it is only loaded at
        # startup and thus cannot be changed via a reload.
        #tls-cert-bundle: "/etc/ssl/cert.pem"

remote-control:
        control-enable: yes
        control-interface: /var/run/unbound.sock

stub-zone:
        name: "ampr.org."
        stub-addr: 44.1.1.44
        stub-host: ns2.us.ardc.org
        stub-host: ns.ardc.org
        stub-host: ns1.de.ardc.org
        stub-host: a.gw4.uk

stub-zone:
        name: "44.in-addr.arpa."
        stub-addr: 44.1.1.44
        stub-host: ns2.us.ardc.org
        stub-host: ns.ardc.org
        stub-host: ns1.de.ardc.org
        stub-host: a.gw4.uk
        stub-first: yes

stub-zone:
        name: "128.44.in-addr.arpa."
        stub-addr: 44.1.1.44
        stub-host: ns2.us.ardc.org
        stub-host: ns.ardc.org
        stub-host: ns1.de.ardc.org
        stub-host: a.gw4.uk
        stub-first: yes

This configuration sets some non-default options in the server: section, such as what interface to listen on for incoming connections, and options for what machines are allowed to send us queries. Here, we listen on all addresses on all interfaces for both IPv4 and IPv6 and we allow any AMPRNet host to send us queries.

The remote-control: section enables and configures a Unix domain socket that allows us to control the unbound daemon with the client control program, unbound-control; this way, we can ask it for performance and usage statistics, force it to flush its cache, etc, without stopping and restarting it.

The most interesting parts are the stub-zone: sections. These allow us to tell unbound about servers that are authoritative for particular zones, bypassing querying through the root for domains under those zones. In the three sections given here, we tell it to query the ARDC-administered non-recursive authoritative servers for the ampr.org, 44.in-addr.arpa and 128.44.in-addr.arpa zones; that is, for anything related to AMPRNet, we forward directly to the authoritative servers.

Note the stub-first: yes lines for the two reverse domains: some reverse domains are delegated to other services. This line says to try the ARDC servers first, and if those return an error, to perform the standard query from the root.

Once the server is configured, we can enable it by adding a line to /etc/rc.conf.local:

unbound_flags=""

Now, if we reboot, we will find the unbound daemon running the next time we login. We should be able to direct DNS queries to the local server now, and we can edit the /etc/resolv.conf file to include a reference to our unbound instance. For example, our resolv.conf file might look something like:

lookup file bind
domain your-call.ampr.org
search your-call.ampr.org ampr.org
nameserver 127.0.0.1

Of course, one likely wants to query one's own callsign based subdomain, not "your-call".

Now, other machines can be configured to connect to your unbound instance. Here is an example from a machine at KZ2X:

lookup file bind
domain kz2x.ampr.org
search kz2x.ampr.org ampr.org
nameserver 44.44.48.29
nameserver 8.8.8.8
nameserver 1.1.1.1

Note that 44.44.48.29 is the machine that runs unbound.

Congratulations! You have set up a caching, validating, recursive resolver that can serve DNS to any machine on AMPRNet.