How to Installing and Configure Unbound on Ubuntu Server 12.04

Unbound is a validating, recursive, and caching DNS resolver. created with C programming and Developed by NLnetlabs . Unbound’s design is a set of modular components which incorporate features including enhanced security (DNSSEC) validation, Internet Protocol Version 6 (IPv6), and a client resolver library API as an integral part of the architecture. Originally written for Posix-compatible Unix-like operating system, Unbound currently runs on FreeBSD, OpenBSD, NetBSD, and Linux.

Unbound now available in new version 1.4.18, it was released on August 2 2012. On ubuntu server, unbound packge is available in official ubuntu repository but still in version 1.4.16. The install and configuration of Unbound on Ubuntu Server 12.04 is incredibly easy. Follow the guide How to Installing and Configure Unbound on Ubuntu Server 12.04

Installing Unbound

Login to your ubuntu server using ssh. before installing unbound, make sure your package repositories and installed programs are up to date.

sudo apt-get update

install unbound:

sudo apt-get install unbound

Configure Unbound

Unbound configuration file will be located at /etc/unbound/unbound.conf.

Login as root, Enter to directory /etc/unbound

sudo -i

cd /etc/unbound

Download the latest root DNS hints file from 

wget ftp://ftp.internic.net/domain/named.cache

Run unbound-control-setup to generate the necessary TLS key files

unbound-control-setup

Change owner all file unbound_* in the directory /etc/unbound to (unbound:root = user unbound : group root)

chown unbound:root unbound_*

Change permissions all file unbound_* to 440

chown unbound:root unbound_*

Backup old unbound configuration with following command

mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.default

Create new file unbound configuration, just copy and paste these config in to terminal:

cat > /etc/unbound/unbound.conf <<-EOF
server:
access-control: 127.0.0.0/8 allow
access-control: 192.168.42.0/24 allow
auto-trust-anchor-file: "/var/lib/unbound/root.key"
verbosity: 1
statistics-interval: 120
num-threads: 1
interface: 0.0.0.0
outgoing-range: 512
num-queries-per-thread: 1024
msg-cache-size: 16m
rrset-cache-size: 32m
msg-cache-slabs: 4
rrset-cache-slabs: 4
cache-max-ttl: 86400
infra-host-ttl: 60
infra-lame-ttl: 120
infra-cache-numhosts: 10000
infra-cache-lame-size: 10k
do-ip4: yes
do-ip6: no
do-udp: yes
do-tcp: yes
do-daemonize: yes
logfile: ""
use-syslog: no
identity: "DNS"
version: "1.4"
hide-identity: yes
hide-version: yes
harden-glue: yes
do-not-query-address: 127.0.0.1/8
do-not-query-localhost: yes
module-config: "iterator"
local-zone: "localhost." static
local-data: "localhost. 10800 IN NS localhost."
local-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
local-data: "localhost. 10800 IN A 127.0.0.1"
local-zone: "127.in-addr.arpa." static
local-data: "127.in-addr.arpa. 10800 IN NS localhost."
local-data: "127.in-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 2 3600 1200 604800 10800"
local-data: "1.0.0.127.in-addr.arpa. 10800 IN PTR localhost."
local-zone: "ubuntuprecise.net." static
local-data: "ubuntuprecise.net. 86400 IN NS ns1.ubuntuprecise.net."
local-data: "ubuntuprecise.net. 86400 IN SOA ubuntuprecise.net. proxy.ubuntuprecise.net. 3 3600 1200 604800 86400"
local-data: "ubuntuprecise.net. 86400 IN A 192.168.34.4"
local-data: "www.ubuntuprecise.net. 86400 IN A 192.168.34.4"
local-data: "ns1.ubuntuprecise.net. 86400 IN A 192.168.34.4"
local-data: "mail.ubuntuprecise.net. 86400 IN A 192.168.34.4"
local-data: "ubuntuprecise.net. 86400 IN MX 10 mail.ubuntuprecise.net."
local-data: "ubuntuprecise.net. 86400 IN TXT v=spf1 a mx ~all"
local-zone: "42.168.192.in-addr.arpa." static
local-data: "42.168.192.in-addr.arpa. 10800 IN NS ubuntuprecise.net."
local-data: "42.168.192.in-addr.arpa. 10800 IN SOA ubuntuprecise.net. proxy.ubuntuprecise.net. 4 3600 1200 604800 864000"
local-data: "1.42.168.192.in-addr.arpa. 10800 IN PTR ubuntuprecise.net."
forward-zone:
name: "."
forward-addr: 8.8.8.8
forward-addr: 8.8.4.4
forward-addr: 208.67.222.222
forward-addr: 208.67.220.220
remote-control:
control-enable: yes
control-interface: 127.0.0.1
control-interface: 192.168.42.1
control-port: 953
server-key-file: "/etc/unbound/unbound_server.key"
server-cert-file: "/etc/unbound/unbound_server.pem"
control-key-file: "/etc/unbound/unbound_control.key"
control-cert-file: "/etc/unbound/unbound_control.pem"
EOF

Check unbound configuration with following command:

unbound-checkconf /etc/unbound/unbound.conf

Restart unbound service

service unbound restart

When you restart unbound and get an error messege like this:

* Restarting recursive DNS server unbound

[1351477671] unbound[20492:0] error: bind: address already in use
[1351477671] unbound[20492:0] fatal error: could not open ports

You need stop dnsmasq service.

service dnsmasq stop

If you have installed squid proxy server on your machine, add this option on squid file configuration. then restart squid server.

dns_nameservers 127.0.0.1 192.168.42.1

service squid3 restart

use this command to check unbound performance:

unbound-control stats

Ubuntu Linux and Cisco switch link aggregation (load balancing, bonding)

Link aggregation between Cisco 3750 switch and Ubintu 9.10
Ubuntu configuration:
Install ifenslave — Attach and detach slave network devices to a bonding device.

apt-get install  ifenslave

Edit or create file /etc/modprobe.d/aliases.conf

alias bond0 bonding
options bonding mode=4 miimon=100

where mode 4 – IEEE 802.3ad Dynamic link aggregation. Creates aggregation groups that share the same speed and
duplex settings. Utilizes all slaves in the active aggregator according to the 802.3ad specification.
Edit /etc/network/interfaces.

auto bond0
iface bond0 inet static
        address 172.20.10.10
        netmask 255.255.255.0
        network 172.20.10.0
        broadcast 172.20.10.255
        post-up ifenslave bond0 eth0 eth1
        gateway 172.20.10.254
        dns-nameservers 172.20.10.254
        dns-search axarva.co.id

UPDATE (02.01.2012): Ubuntu 11.10 (oneiric).

1.  Edit or create file /etc/modprobe.d/aliases.conf

alias netdev-bond0 bonding
options bonding mode=4 miimon=100

or

2. To run bonding first put module “bonding” in “/etc/modules” :

# /etc/modules: kernel modules to load at boot time.
#
# This file contains the names of kernel modules that should be loaded
# at boot time, one per line. Lines beginning with "#" are ignored.
loop
lp
rtc
bonding

In “/etc/network/interfaces”

auto bond0
iface bond0 inet static
        slaves eth0 eth1
        bond_mode 4
        bond_miimon 100
        address 172.20.10.10
        netmask 255.255.255.0
        network 172.20.10.0
        broadcast 172.20.10.255
        post-up ifenslave bond0 eth0 eth1

Cisco configuration ( Gi1/0/1 and Gi1/0/2 will be aggregated ):

cisco-3750(config)#interface range GigabitEthernet 1/0/1, GigabitEthernet 1/0/2
cisco-3750(config-if-range)#switchport trunk encapsulation dot1q
cisco-3750(config-if-range)#switchport trunk allowed vlan 10,20
cisco-3750(config-if-range)#switchport mode trunk
cisco-3750(config-if-range)#channel-group 1 mode active
Creating a port-channel interface Port-channel 1
cisco-3750(config-if-range)#end
cisco-3750#

Configuration of interface Port-Channel 1 must be exactly the same as Gi1/0/1 and Gi1/0/2.

cisco-3750#sh ru int Po1
Building configuration...
Current configuration : 159 bytes
!
interface Port-channel1
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,20
end

If you want to modify configuration of aggregated interfaces, modify only configuration of Port-Channel interface.
And the last step is to set load-balance algorithm:

cisco-3750(config)#port-channel load-balance src-dst-ip
cisco-3750#sh etherchannel load-balance
EtherChannel Load-Balancing Operational State (src-dst-ip):
Non-IP: Source XOR Destination MAC address
  IPv4: Source XOR Destination IP address
  IPv6: Source XOR Destination IP address

cisco-3750#show etherchannel summary
Flags:  D - down        P - in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi1/0/1(P)  Gi1/0/2(P)

cisco-3750#
cisco-3750#show etherchannel protocol
                Channel-group listing:
                ----------------------
Group: 1
----------
Protocol:  LACP

May be useful for a network of friends, survivors try.