UnboundRecursorConfig

From NURDspace
Revision as of 16:40, 25 February 2026 by R3boot (talk | contribs) (Created page with "== /etc/unbound/unbound.conf == server: interface: 127.0.0.1 access-control: 127.0.0.1/32 allow # Allow xs from localhost access-control: 192.168.122.0/24 allow # Allow xs from virtual machines on laptop trust-anchor-file: "/etc/unbound/dnssec-root.key" unblock-lan-zones: yes insecure-lan-zones: yes chroot: "" remote-control: control-enable: yes include: /etc/unbound/conf.d/*.conf == /etc/unbound/conf.d/nurdspace.conf == server:...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

/etc/unbound/unbound.conf

server:
  interface: 127.0.0.1
  access-control: 127.0.0.1/32 allow      # Allow xs from localhost
  access-control: 192.168.122.0/24 allow  # Allow xs from virtual machines on laptop
  trust-anchor-file: "/etc/unbound/dnssec-root.key"
  unblock-lan-zones: yes
  insecure-lan-zones: yes
  chroot: ""

remote-control:
  control-enable: yes

include: /etc/unbound/conf.d/*.conf

/etc/unbound/conf.d/nurdspace.conf

server:
  domain-insecure: "nurdspace.nl"
  domain-insecure: "nurd.space"

forward-zone:
  name: "space.nurdspace.nl"
  forward-addr: 10.208.1.53

forward-zone:
  name: "git.nurd.space"
  forward-addr: 10.208.1.53

forward-zone:
  name: "saml.nurd.space"
  forward-addr: 10.208.1.53

forward-zone:
  name: "metrics.nurd.space"
  forward-addr: 10.208.1.53

forward-zone:
  name: "nurd.space"
  forward-addr: 10.208.1.53

forward-zone:
  name: "nurdspace.nl"
  forward-addr: 10.208.1.53

forward-zone:
  name: "portal.nurdspace.nl"
  forward-addr: 10.208.1.53

forward-zone:
  name: "vm.nurd.space"
  forward-addr: 10.208.1.53

forward-zone:
  name: "lan.nurd.space"
  forward-addr: 10.208.1.53

forward-zone:
  name: "dhcp.nurd.space"
  forward-addr: 10.208.1.53

update-unbound-blocklists

#!/usr/bin/env bash

set -euo pipefail

UPSTREAM_BLACKLISTS="
https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt
https://www.github.developerdan.com/hosts/lists/facebook-extended.txt
https://www.github.developerdan.com/hosts/lists/amp-hosts-extended.txt
https://www.github.developerdan.com/hosts/lists/dating-services-extended.txt
https://www.github.developerdan.com/hosts/lists/hate-and-junk-extended.txt
https://www.github.developerdan.com/hosts/lists/tracking-aggressive-extended.txt
https://raw.githubusercontent.com/PolishFiltersTeam/KADhosts/master/KADhosts.txt
https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Spam/hosts
https://v.firebog.net/hosts/static/w3kbl.txt
https://adaway.org/hosts.txt
https://v.firebog.net/hosts/AdguardDNS.txt
https://v.firebog.net/hosts/Admiral.txt
https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
https://v.firebog.net/hosts/Easylist.txt
https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext
https://raw.githubusercontent.com/FadeMind/hosts.extras/master/UncheckyAds/hosts
https://raw.githubusercontent.com/bigdargon/hostsVN/master/
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt
https://v.firebog.net/hosts/Easyprivacy.txt
https://v.firebog.net/hosts/Prigent-Ads.txt
https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.2o7Net/hosts
https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt
https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt
https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareHosts.txt
https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt
https://v.firebog.net/hosts/Prigent-Crypto.txt
https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Risk/hosts
https://bitbucket.org/ethanr/dns-blacklists/raw/8575c9f96e5b4a1308f2f12394abd86d0927a4a0/bad_lists/Mandiant_APT1_Report_Appendix_D.txt
https://phishing.army/download/phishing_army_blocklist_extended.txt
https://malware-filter.gitlab.io/malware-filter/phishing-filter-hosts.txt
https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-malware.txt
https://raw.githubusercontent.com/Spam404/lists/master/main-blacklist.txt
https://raw.githubusercontent.com/AssoEchap/stalkerware-indicators/master/generated/hosts
https://urlhaus.abuse.ch/downloads/hostfile/
https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser
"

CACHE_DIR="${HOME}/.cache/unbound_blocklists"
CACHE_EXPIRY="43200"

install -d -m 0755 "${CACHE_DIR}"

NOW="$(date +%s)"

function fetch_blocklist {
    BLOCKLIST="${1}"
    CACHE_FILE="${2}"

    curl -s -o "${CACHE_FILE}" "${BLOCKLIST}"
}

echo "server:"
(for LIST in ${UPSTREAM_BLACKLISTS}; do
    CACHE_FILE="${CACHE_DIR}/$(echo ${LIST} | sed -e 's,https://,,g' -e 's,\/,_,g')"
    if [[ -f "${CACHE_FILE}" ]]; then
        FILE_AGE="$(stat -c %Y ${CACHE_FILE})"
        DIFFERENCE=$(expr ${NOW} - ${FILE_AGE})
        if [[ ${DIFFERENCE} -gt ${CACHE_EXPIRY} ]]; then
            rm -f "${CACHE_FILE}"
            fetch_blocklist "${LIST}" "${CACHE_FILE}"
        fi
    else
        fetch_blocklist "${LIST}" "${CACHE_FILE}"
    fi

    cat "${CACHE_FILE}" | grep -E -v '^$|^#' | \
        sed -e 's,0.0.0.0 ,,g' -e 's,127.0.0.1 ,,g' -e 's,::1 ,,g' -e 's,\#.*,,g' -e 's,\.\.,\.,g' -e 's,.*@,,g' \
        | tr -d '\r' | awk '{ print $1 }' | sed -e 's,\.$,,g'
done) | sort | uniq | while read DOMAIN; do
    echo "    local-data: \"${DOMAIN}. 10800 IN A 127.0.0.1\""
done