Docker Image for Unbound DNS Cache server (Works for Raspberry PI)
Features
- DNS Caching using Unbound - unbound.net
- Block ad hosts listed in:
- https://github.com/StevenBlack/: Unified list + Fakenews + Gambling + P*rn
- https://raw.githubusercontent.com/Sekhan/TheGreatWall/master/TheGreatWall.txt
- https://raw.githubusercontent.com/jdlingyu/ad-wars/master/hosts
- https://raw.githubusercontent.com/VeleSila/yhosts/master/hosts
- https://raw.githubusercontent.com/tiuxo/hosts/master/ads
- Cron job to update blocked ad hosts daily.
- Support for custom script execution (/app-config)
- Support for linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6
- Alpine based tiny images
How to use
docker run -itd --name unbound \
-p 53:53/tcp \
-p 53:53/udp \
satishweb/unbound
Docker Stack configuration:
services:
unbound:
image: satishweb/unbound
hostname: unbound
networks:
- default
environment:
DEBUG: "0"
# DOMAIN_WHITELIST: "domain1.com domain2.com subdomain.domain3.com"
SOURCE_StevenBlack_Unified_Hosts: "true"
SOURCE_StevenBlack_Fakenews: "true"
SOURCE_StevenBlack_Gambling: "true"
SOURCE_StevenBlack_Porn: "true"
SOURCE_TheGreatWall_Default: "true"
SOURCE_AdWars_Default: "true"
SOURCE_VeleSila_Default: "true"
SOURCE_Tiuxo_Default: "true"
volumes:
# - ./unbound.conf:/etc/unbound/unbound.conf # For custom config
# Mount app-config script with your customizations
# - ./app-config:/app-config
deploy:
replicas: 1
# placement:
# constraints:
# - node.labels.type == worker
labels:
- "com.satishweb.description=Unbound DNS Cache Service"
How to setup DOH Server on Linux/Mac/RaspberryPI in minutes:
Using Docker Compose
Requirements:
- RaspeberryPi/Linux/Mac with Docker preinstalled (Required)
- DNS Server Setup on AWS R53 (Other providers supported)
- AWS Access Key, Secret key and R53 DNS Hosted Zone ID (for LetsEncrypt based auto installation of SSL Certs) (Optional)
Steps
- Visit https://github.com/satishweb/docker-doh/releases and download latest release to your server
wget https://github.com/satishweb/docker-doh/archive/v2.3.3.zip
unzip v2.3.3.zip
cp -rf docker-doh-2.2.4-1/examples/docker-compose-doh-server doh-server
rm -rf v2.3.3.zip docker-doh-2.2.4-1
cd doh-server
- Copy env.sample.conf to env.conf and update environment variables
EMAIL=user@example.com
DOMAIN=example.com
SUBDOMAIN=dns
AWS_ACCESS_KEY_ID=AKIKJ_CHANGE_ME_FKGAFVA
AWS_SECRET_ACCESS_KEY=Nx3yKjujG8kjj_CHANGE_ME_Z/FnMjhfJHFvEMRY3
AWS_REGION=us-east-1
AWS_HOSTED_ZONE_ID=Z268_CHANGE_ME_IQT2CE6
DOMAIN_WHITELIST="domain1.com domain2.com subdomain.domain3.com"
- Launch services
./launch.sh
- Add your custom hosts to override DNS records if needed.
mkdir -p data/unbound/custom
vi data/unbound/custom/custom.hosts
Contents:
local-zone: "SUB1.example.com" redirect
local-data: "SUB1.example.com A 192.168.0.100"
local-zone: "SUB2.example.com" redirect
local-data: "SUB2.example.com A 192.168.0.101"
- What is my DOH address?
https://dns.example.com/getnsrecord
- How do I test DoH Server?
curl -w '\n' 'https://dns.example.com/getnsrecord?name=google.com&type=A'
Common Issues and how to debug them
- Proxy is still running with self signed certificate
- Check data/proxy/certs/acme.json contents.
- Enable debug mode for proxy by editing proxy service in docker-compose.yml. Run launch command again for changes to take effect.
- Check proxy container logs for errors.
Note: If you are using IAM account for R53 access, please make sure you have below permissions added in access policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Action": [
"route53:GetChange",
"route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets"
],
"Resource": [
"arn:aws:route53:::hostedzone/*",
"arn:aws:route53:::change/*"
]
},
{
"Sid": "",
"Effect": "Allow",
"Action": "route53:ListHostedZonesByName",
"Resource": "*"
}
]
}
-
Can not bind 53 port for unbound service
- Unbound service is configured to bind 53 port on the docker host.
- Sometimes systemd-resolved service blocks that port and it needs to be stopped
- run
sudo service systemd-resolved stop;sudo apt-get -y purge systemd-resolved
and then retry again - Unbound service port mappings can be commented out if DOH service is the only DNS client for it.
-
Can not bind port 80 and 443 for proxy service.
- Another program on the docker host or one of the docker container has aquired the same ports.
- You need to stop those programs or change the proxy service ports to unused ports
IPV6 Support
- Docker compose configuration with IPV6 support will be added in future.
How to use DOH Server?
Setup your Router (Best experience)
- Login to your router and search for DHCP settings
- Setup DNS settings to the IP of your DOH server.
Note: This will make all your client systems/phones connected to your router use this your DNS server. Note: This will not make clients use DOH but it will end up using unbound private DNS service that protects you from ISP.
Linux, Mac, Windows Clients
- Install Cloudflared for Linux, Mac, Windows using below link
https://developers.cloudflare.com/argo-tunnel/downloads/
- Set your DOH server as upstream for cloudflared with below configuration
- Linux: /usr/local/etc/cloudflared/config.yml
- Mac: /usr/local/etc/cloudflared/config.yaml
- Windows: Need help here, if you know where to configure, please contribute
proxy-dns: true
proxy-dns-upstream:
- https://dns.example.com/getnsrecord
Note: You will need to ensure dnsmasq is uninstalled from your client system before using cloudflared
Android
- Install Infra app from Play Store
https://play.google.com/store/apps/details?id=app.intra&hl=en_US
- Configure infra app to use your DOH server
Infra App -> Settings -> Select DNS over HTTPS Server -> Custom server URL
Value: https://dns.example.com/getnsrecord
Build Docker image
docker build . --no-cache -t satishweb/unbound
Pull Docker Hub Image
docker pull satishweb/unbound
Credits
- AD Block Hosts: https://github.com/StevenBlack/hosts
- Unbound: http://www.unbound.net