Setting up a local DNS server with Unbound

Finishing Up

When your configuration is ready, just boot your server up with the following command:

# /etc/init.d/unbound start

This command will bring up a caching DNS server with anti-advertisement, anti-malware, and anti-phishing capabilities, as well as a limited capability for validating the authenticity of the DNS responses it takes. Not bad at all.

The only task left to do is to configure the devices in your LAN to use this server. There are three main ways to do this. You can manually configure each one to use your DNS server, which is usually impractical. The second option is to configure your network router to assign your server via DHCP to each device that connects to the network. This is the easiest way, and it will work most of the time, as long as your router supports assigning custom DNS servers to the devices in your LAN.

There is a third, evil option, that I like to use when I have to deal with devices that will ignore DNS servers provided by DHCP. This method is to instruct the router to redirect queries to unauthorized DNS servers to your local DNS instance, using ds-nat. In practice, you are performing a man-in-the-middle attack by letting your local DNS server pretend to be the DNS server the rogue device is trying to connect to. This requires a router capable of advanced firewall configuration. But such mean deeds are the subject for another article.

The Author

Rubén Llorente is a mechanical engineer whose job is to ensure that the security measures for the IT infrastructure of a small clinic are law compliant and safe. He is also an OpenBSD enthusiast and a weapon collector.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Security Lessons: DNSSEC

    One of the largest holes in the Internet is finally plugged.

  • DNSSEC

    Some Internet exploits target name resolution servers. DNSSEC uses cryptography to protect the name resolution service.

  • Security Lessons: DNS Security

    Kurt describes how to keep bad guys out of your network using a targeted filtering approach.

  • Bind 10 Test Drive

    Admins have waited all of five years for the 10th major release of the Bind name server, which appeared at the end of March this year. The latest release is a complete rewrite of the DNS server, with a modular design and new configuration tools, but is it ready for business?

  • NEWS

    In the news: Microsoft Edge Coming to Linux; Open Invention Network Backs Gnome Project Against Patent Troll; Fedora 31 Released; openSUSE OBS Can Now Build Windows WSL Images; Sudo Vulnerability; Hetzner Launches New Ryzen-Based Dedicated Root Servers; and IBM Joins the Mayflower Autonomous Ship Project.

comments powered by Disqus