What's new

Unbound unbound_manager (Manager/Installer utility for unbound - Recursive DNS Server)

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Today, I managed to get WireGuard running with 1.1.1.1 WARP on my local Windows 10 PC.
I guess, now I do not profit from running unbound on my router anymore?
How can I configure WireGuard to use unbound?

This is my WireGuard config now:
Code:
[Interface]
PrivateKey = xxx
Address = 172.16.0.2/32, fd01:5ca1:ab1e:882a:4a88:e4e6:a4f3:a66f/128
DNS = 1.1.1.1

[Peer]
PublicKey = xxx
AllowedIPs = 0.0.0.0/5, 8.0.0.0/7, 11.0.0.0/8, 12.0.0.0/6, 16.0.0.0/4, 32.0.0.0/3, 64.0.0.0/2, 128.0.0.0/3, 160.0.0.0/5, 168.0.0.0/6, 172.0.0.0/12, 172.32.0.0/11, 172.64.0.0/10, 172.128.0.0/9, 173.0.0.0/8, 174.0.0.0/7, 176.0.0.0/4, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4
Endpoint = engage.cloudflareclient.com:2408

Edit:
I recon, this may the wrong thread...
 
Last edited:
Hi Martineau,

I have also noticed the following additional errors (in red boxes) with my RT-AC86U:
View attachment 22603

While Unbound seem to be correctly working, I am still wondering if the above reported issues may have prevented the script to correctly write back some important information for my .
'unbound_manager' v2.18 allowed selection of the option during the initial install (it calls a 3rd party script) before unbound has physically started.

'unbound_manager' v3.0x when performing the install from amtm in 'Easy' mode doesn't allow the install option until unbound is installed and UP.

I believe @juched has now incorporated a check to ensure that his script doesn't attempt to request/process data from unbound until it has initialized?

Not sure which version of 'unbound_manager' you are using?, but for now you may safely ignore the error as it doesn't affect unbound, and the Statistics gathering script will correctly work after a short delay.
 
'unbound_manager' v2.18 allowed selection of the option during the initial install (it calls a 3rd party script) before unbound has physically started.

'unbound_manager' v3.0x when performing the install from amtm in 'Easy' mode doesn't allow the install option until unbound is installed and UP.

I believe @juched has now incorporated a check to ensure that his script doesn't attempt to request/process data from unbound until it has initialized?

Not sure which version of 'unbound_manager' you are using?, but for now you may safely ignore the error as it doesn't affect unbound, and the Statistics gathering script will correctly work after a short delay.
Thanks for your fast reply Martineau.

For you information it happened with v3.oo after having managed to remove Unbound because of the previously reported "Starting unbound... failed." yesterday.

As I previously said, Unbound is now correctly working. Unbound like the other Asuswrt-Merlin tools is a very helpful and robust tool (kudo for all the developers).

Cheer,

Denis
 
cant enable rpz firewall in 3.02 with dev conf file:

Code:
'unbound_rpz.sh' download FAILED with curl error 404

Try installing again.
'unbound_manager' v2.18 allowed selection of the option during the initial install (it calls a 3rd party script) before unbound has physically started.

'unbound_manager' v3.0x when performing the install from amtm in 'Easy' mode doesn't allow the install option until unbound is installed and UP.

I believe @juched has now incorporated a check to ensure that his script doesn't attempt to request/process data from unbound until it has initialized?

Not sure which version of 'unbound_manager' you are using?, but for now you may safely ignore the error as it doesn't affect unbound, and the Statistics gathering script will correctly work after a short delay.

Oh, I see now. I added a case to not run commands for unbound-control in unbound_rpz.sh, but never did that for unbound_stats.sh. What is the desired operation in unbound is not running? Install but don't generate the stats? In that case the GUI would be blank and somewhat broken for up to an hour. Thoughts?

-- edit --

if after install and unbound is running you could run unbound_stats.sh generate command, then I can remove the generate command on startup.
 
I've uploaded BETA 'unbound_manager' v3.02 and 'unbound.conf' v1.09 to support your proposal.

Try it out in 'Advanced' menu mode

e.g. update the 'unbound_manager.sh' script
Code:
e  = Exit Script

A:Option ==> uf dev

    unbound_manager.sh downloaded successfully Github 'dev/development' branch

unbound Manager UPDATE Complete! 22e316f94dcbd1a0cbebeb06a330b147
and you will need to retrieve the associated 'unbound.conf'
Code:
e  = Exit Script

A:Option ==> i dev

<snip>

Retrieving the 13 InterNIC Root DNS Servers from 'https://www.internic.net/domain/named.cache'.....
######################################################################################################################################################################################## 100.0%
Retrieving Custom unbound configuration
 unbound.conf downloaded successfully Github 'dev/development' branch
Checking IPv6.....
Customising unbound configuration Options:
unbound-checkconf: no errors in /opt/var/lib/unbound/unbound.conf


 Shutting down unbound...              done.
 Starting unbound...              done.

Checking status, please wait..... unbound OK

Auto install unbound Customisation complete 0 minutes and 21 seconds elapsed - Please wait for up to 10 seconds for status.....
I have replaced 'RPZ Firewall' references with 'DNS Firewall'
Code:
e  = Exit Script

A:Option ==> rpz

Do you want to enable DNS Firewall?

    Reply 'y' or press [Enter]  to skip
y
    unbound_rpz.sh downloaded successfully Github 'dev/development' branch
    rpzsites downloaded successfully Github 'dev/development' branch

Unbound-RPZ.sh - V1.0.1 running...
Attempting to Download 1 of 1 from .
######################################################################## 100.0%
Reload unbound for zone named rpz.urlhaus.abuse.ch
error no auth-zone rpz.urlhaus.abuse.ch

    unbound DNS Firewall ENABLED
Code:
e  = Exit Script

A:Option ==> ?

    Version=3.02
    Github                        md5=22e316f94dcbd1a0cbebeb06a330b147

<snip>

    [✔] Router Graphical GUI statistics TAB installed
    [✔] unbound-control FAST response ENABLED
    [✔] DNS Firewall ENABLED

'rpz disable' turns off the 'DNS Firewall'

EDIT: The creation of the cron job in 'services-start' appears to have gone AWOL in your script...could have sworn that it was there before.:confused:

outstanding work Martineau - just brilliant
 
Today, I managed to get WireGuard running with 1.1.1.1 WARP on my local Windows 10 PC.
I guess, now I do not profit from running unbound on my router anymore?
How can I configure WireGuard to use unbound?

This is my WireGuard config now:
Code:
[Interface]
PrivateKey = xxx
Address = 172.16.0.2/32, fd01:5ca1:ab1e:882a:4a88:e4e6:a4f3:a66f/128
DNS = 1.1.1.1

[Peer]
PublicKey = xxx
AllowedIPs = 0.0.0.0/5, 8.0.0.0/7, 11.0.0.0/8, 12.0.0.0/6, 16.0.0.0/4, 32.0.0.0/3, 64.0.0.0/2, 128.0.0.0/3, 160.0.0.0/5, 168.0.0.0/6, 172.0.0.0/12, 172.32.0.0/11, 172.64.0.0/10, 172.128.0.0/9, 173.0.0.0/8, 174.0.0.0/7, 176.0.0.0/4, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4
Endpoint = engage.cloudflareclient.com:2408

Edit:
I recon, this may the wrong thread...
well the easiest way is to have unbound configured on an RPI on your network. then you can easily install wireguard, open proper ports on router, and bam you are done. hard way is to try to configure wireguard on entware if it is possible. then you got alot of configuring you have to do on the router.

The one thing i like about my unbound-wireguard setup is that it was easy to configure ipv6-ipv4 dual stack support on. No issues.
 
Last edited:
Made a quick script until the SSL issue with unbound is figured out.

1. Download script
https://github.com/juched78/Unbound-Asuswrt-Merlin/blob/develop/unbound_rpz.sh
place in /jffs/addons/unbound/unbound_rpz.sh

2. Download rpzsites data file
https://github.com/juched78/Unbound-Asuswrt-Merlin/blob/develop/rpzsites
place it in /opt/share/unbound/configs

3. Run script once
chmod +x /jffs/addons/unbound/unbound-rpz.sh
/jffs/addons/unbound/unbound-rpz.sh

It will keep running every 15 minutes, updating with the latest RPZ and applying it without restarting unbound.

Easy setup. Up and running. Great work @juched
 
Oh, I see now. I added a case to not run commands for unbound-control in unbound_rpz.sh, but never did that for unbound_stats.sh. What is the desired operation in unbound is not running? Install but don't generate the stats? In that case the GUI would be blank and somewhat broken for up to an hour. Thoughts?

-- edit --

if after install and unbound is running you could run unbound_stats.sh generate command, then I can remove the generate command on startup.
Clearly it is prudent that 'unbound_manager' provides interactive feedback (when executing your script) that indicates the 'install' request resulted in a successful set up of the necessary GUI elements/database/collector environment.

After that, generating the actual stats in the background is of no concern to 'unbound_manager' - be it every hour or every minute. ;)

So, to save me having to do anything :D, I suggest you change one line:
Code:
 install)
  Install_Dependancies
  Auto_Startup create
  Auto_ServiceEvent create
  Auto_Cron create
  Mount_WebUI
  Create_Dirs
  Generate_UnboundStats
  exit 0
 ;;
Change to
Code:
 install)
  Install_Dependancies
  Auto_Startup create
  Auto_ServiceEvent create
  Auto_Cron create
  Mount_WebUI
  Create_Dirs
  [ -n "$(pidof unbound)" ] && Generate_UnboundStats || { sh $0 "generate" & }
  exit 0
Works for me! :p

EDIT:....well actually :eek::eek::eek::(:(:(

Code:
Do you want to add router GUI TAB to Graphically display stats?

    Reply 'y' or press [Enter]  to skip
y

    Installing @juched's GUI TAB to Graphically display unbound stats.....
    unbound_statsXXX.sh downloaded successfully  <== ***Hacked version by Martineau***
    unboundstats_www.asp downloaded successfully
Mounting Unbound_Stats.sh WebUI page as user3.asp
Saving MD5 of installed file /jffs/addons/unbound/unboundstats_www.asp to /jffs/addons/unbound/www-installed.md5

Do you want to install Ad and Tracker (Ad Block) blocking?

    Reply 'y' or press [Enter]  to skip
Checking if Unbound is running to generate stats...
Unbound not running yet, try again 0...
Unbound not running yet, try again 1...
Unbound not running yet, try again 2...
Unbound not running yet, try again 3...
Unbound not running yet, try again 4...
Unbound not running yet, try again 5...
Unbound not running yet, try again 6...
Unbound not running yet, try again 7...
Unbound not running yet, try again 8...
Unbound not running yet, try again 9...
Unbound not running yet, try again 10...
Unbound not running yet, try again 11...
Unbound not running yet, try again 12...

 Starting unbound...              done.

Manual install unbound Customisation complete 1 minutes and 15 seconds elapsed - Please wait for up to 10 seconds for status.....

awk: cmd. line:1: Division by zero
Calculated Cache Hit Percentage:
awk: cmd. line:1: Unexpected token
Adding new value to DB...
Error: near line 2: near ")": syntax error
Calculating Daily data...
Calculating Weekly and Monthly data...

    Installation of unbound completed


    Router Configuration recommended pre-reqs status:

<snip>

    Options: unbound Advanced install - User will be prompted to install options

    [✔] unbound CPU/Memory Performance tweaks
    [✔] Router Graphical GUI statistics TAB installed
    [✔] unbound-control FAST response ENABLED



unbound (pid 25022) is running... uptime: 0 Days, 00:00:11 version: 1.10.0 # rgnldo Github Version=v1.09 Martineau update (Date Loaded by unbound_manager Mon Apr 13 09:54:04 DST 2020)

u = Push to Github PENDING for (Minor Hotfix) unbound_manager update >>>>  v3.01

i  = Update unbound and configuration ('/opt/var/lib/unbound/')        l  = Show unbound log entries (lo=Enable Logging)
z  = Remove unbound/unbound_manager                                    v  = View ('/opt/var/lib/unbound/') unbound Configuration (vx=Edit)
3  = Advanced Tools                                                    rl = Reload Configuration (Doesn't halt unbound) e.g. 'rl test1[.conf]' (Recovery use 'rl reset/user')
?  = About Configuration                                               oq = Query unbound Configuration option e.g 'oq verbosity' (ox=Set) e.g. 'ox log-queries yes'

rs = Restart (or Start) unbound (use 'rs nocache' to flush cache)      s  = Show unbound Extended statistics (s=Summary Totals; sa=All; http://10.88.8.1:80/user3.asp)

e  = Exit Script

A:Option ==> Outputting histogram performance data...
Outputting answers data...

Not sure if it is feasible to amend your script?

i.e.
Sleep for 1 min if your script is started explicitly with say "generate delay" as arguments before issuing the verbose debug messages etc.

Alternatively, since it is now only an (untidy/cosmetic) issue during an 'Advanced' install, perhaps I should bite the bullet and modify 'unbound_manager' to simply not bother to prompt for ANY option (including your GUI TAB), but assume the advanced user can/will manually issue 'sgui'.
 
Last edited:
since the last unbound update (AX88U) there is no data in the GUI / reinstall has error messages:


Saving MD5 of installed file /jffs/addons/unbound/unboundstats_www.asp to /jffs/addons/unbound/www-installed.md5
awk: cmd. line:1: Division by zero
Calculated Cache Hit Percentage:
awk: cmd. line:1: Unexpected token
Adding new value to DB...

Error: near line 2: near ")": syntax error

ing Daily data...
Calculating Weekly and Monthly data...
Outputting histogram performance data...
Outputting answers data...

can someone help me?
 
since the last unbound update (AX88U) there is no data in the GUI / reinstall has error messages:


Saving MD5 of installed file /jffs/addons/unbound/unboundstats_www.asp to /jffs/addons/unbound/www-installed.md5
awk: cmd. line:1: Division by zero
Calculated Cache Hit Percentage:
awk: cmd. line:1: Unexpected token
Adding new value to DB...

Error: near line 2: near ")": syntax error

ing Daily data...
Calculating Weekly and Monthly data...
Outputting histogram performance data...
Outputting answers data...

can someone help me?
Hopefully you are running 'unbound_manager' v3.01 ?

Simply uninstall/reinstall the feature using option '6' in 'Easy' menu mode or 'sgui uninstall/sgui' in 'Advanced mode'
 
yes, version 3.01

attached the putty log from the reinstall ..
 

Attachments

  • putty.txt
    6.2 KB · Views: 155
well the easiest way is to have unbound configured on an RPI on your network. then you can easily install wireguard, open proper ports on router, and bam you are done. hard way is to try to configure wireguard on entware if it is possible. then you got alot of configuring you have to do on the router.

The one thing i like about my unbound-wireguard setup is that it was easy to configure ipv6-ipv4 dual stack support on. No issues.
You don't need a RPI.
That was easier than I thought, and it's fast as hell!
I just edited the WireGuard config, to point to 192.168.1.1 DNS (instead of 1.1.1.1).
Now, I'm using my router (which is running unbound) as DNS, and Cloudflare WARP on my Windows 10 PC. :)
And I benefit from Diversion adblocking again.
Keywords to find this again: How to use WireGuard and unbound. And read this.
 

Attachments

  • 1.PNG
    1.PNG
    33.4 KB · Views: 185
  • 2.PNG
    2.PNG
    58.6 KB · Views: 180
  • 3.PNG
    3.PNG
    140.8 KB · Views: 189
  • 5.png
    5.png
    10 KB · Views: 158
Last edited:
yes, version 3.01

attached the putty log from the reinstall ..
I don't know what timezone you are in, but can you wait until say xx:15 minutes past the hour then see if there is data? - sounds bizarre, but the cron job will have run, so that might make a difference.
 
I concur.
https://github.com/juched78/Unbound-Asuswrt-Merlin/blob/develop/unbound_rpz.sh
may be alittle rough around the edges and need some fine tuning but overall this is great work so far.

Agree. if you check out the dev branch you will see I have made this into a more fully-fledged script with install/uninstall and download commands. I plan to merge this into the master once I can review it with @Martineau. But with this format it follows the exact same pattern as unbound_stats.sh, so install/uninstall and it will keep up to date automatically and keep working after reboot.
 
The new integration of RPZ into Unbound provides us with new opportunities but searching around I could not find many free/public RPZ sources. Many are subscription based. The only one that is free to use is URLhaus (that we currently use) is very small, some 870 entries. Nevertheless if someone decided that they need a good RPZ it can be sources and integrated into Unbound.
 
Clearly it is prudent that 'unbound_manager' provides interactive feedback (when executing your script) that indicates the 'install' request resulted in a successful set up of the necessary GUI elements/database/collector environment.

After that, generating the actual stats in the background is of no concern to 'unbound_manager' - be it every hour or every minute. ;)

So, to save me having to do anything :D, I suggest you change one line:
Code:
 install)
  Install_Dependancies
  Auto_Startup create
  Auto_ServiceEvent create
  Auto_Cron create
  Mount_WebUI
  Create_Dirs
  Generate_UnboundStats
  exit 0
 ;;
Change to
Code:
 install)
  Install_Dependancies
  Auto_Startup create
  Auto_ServiceEvent create
  Auto_Cron create
  Mount_WebUI
  Create_Dirs
  [ -n "$(pidof unbound)" ] && Generate_UnboundStats || { sh $0 "generate" & }
  exit 0
Works for me! :p

EDIT:....well actually :eek::eek::eek::(:(:(

Code:
Do you want to add router GUI TAB to Graphically display stats?

    Reply 'y' or press [Enter]  to skip
y

    Installing @juched's GUI TAB to Graphically display unbound stats.....
    unbound_statsXXX.sh downloaded successfully  <== ***Hacked version by Martineau***
    unboundstats_www.asp downloaded successfully
Mounting Unbound_Stats.sh WebUI page as user3.asp
Saving MD5 of installed file /jffs/addons/unbound/unboundstats_www.asp to /jffs/addons/unbound/www-installed.md5

Do you want to install Ad and Tracker (Ad Block) blocking?

    Reply 'y' or press [Enter]  to skip
Checking if Unbound is running to generate stats...
Unbound not running yet, try again 0...
Unbound not running yet, try again 1...
Unbound not running yet, try again 2...
Unbound not running yet, try again 3...
Unbound not running yet, try again 4...
Unbound not running yet, try again 5...
Unbound not running yet, try again 6...
Unbound not running yet, try again 7...
Unbound not running yet, try again 8...
Unbound not running yet, try again 9...
Unbound not running yet, try again 10...
Unbound not running yet, try again 11...
Unbound not running yet, try again 12...

 Starting unbound...              done.

Manual install unbound Customisation complete 1 minutes and 15 seconds elapsed - Please wait for up to 10 seconds for status.....

awk: cmd. line:1: Division by zero
Calculated Cache Hit Percentage:
awk: cmd. line:1: Unexpected token
Adding new value to DB...
Error: near line 2: near ")": syntax error
Calculating Daily data...
Calculating Weekly and Monthly data...

    Installation of unbound completed


    Router Configuration recommended pre-reqs status:

<snip>

    Options: unbound Advanced install - User will be prompted to install options

    [✔] unbound CPU/Memory Performance tweaks
    [✔] Router Graphical GUI statistics TAB installed
    [✔] unbound-control FAST response ENABLED



unbound (pid 25022) is running... uptime: 0 Days, 00:00:11 version: 1.10.0 # rgnldo Github Version=v1.09 Martineau update (Date Loaded by unbound_manager Mon Apr 13 09:54:04 DST 2020)

u = Push to Github PENDING for (Minor Hotfix) unbound_manager update >>>>  v3.01

i  = Update unbound and configuration ('/opt/var/lib/unbound/')        l  = Show unbound log entries (lo=Enable Logging)
z  = Remove unbound/unbound_manager                                    v  = View ('/opt/var/lib/unbound/') unbound Configuration (vx=Edit)
3  = Advanced Tools                                                    rl = Reload Configuration (Doesn't halt unbound) e.g. 'rl test1[.conf]' (Recovery use 'rl reset/user')
?  = About Configuration                                               oq = Query unbound Configuration option e.g 'oq verbosity' (ox=Set) e.g. 'ox log-queries yes'

rs = Restart (or Start) unbound (use 'rs nocache' to flush cache)      s  = Show unbound Extended statistics (s=Summary Totals; sa=All; http://10.88.8.1:80/user3.asp)

e  = Exit Script

A:Option ==> Outputting histogram performance data...
Outputting answers data...

Not sure if it is feasible to amend your script?

i.e.
Sleep for 1 min if your script is started explicitly with say "generate delay" as arguments before issuing the verbose debug messages etc.

Alternatively, since it is now only an (untidy/cosmetic) issue during an 'Advanced' install, perhaps I should bite the bullet and modify 'unbound_manager' to simply not bother to prompt for ANY option (including your GUI TAB), but assume the advanced user can/will manually issue 'sgui'.

I backported and pushed a fix to master branch for unbound_stats.sh. It will now not give an error if unbound isn't running, and will generate empty states, so the UI isn't broken. Once the scripts start running data will populate.

Feel free to call unbound_stats.sh generate later after unbound is up and running, or just let the corn job do its thing.

Note: this version also moves the DB off jffs and onto the USB key, to keep the jffs folder less full, and reduce writes to jffs (a USB key is replaceable :) ).
 
The new integration of RPZ into Unbound provides us with new opportunities but searching around I could not find many free/public RPZ sources. Many are subscription based. The only one that is free to use is URLhaus (that we currently use) is very small, some 870 entries. Nevertheless if someone decided that they need a good RPZ it can be sources and integrated into Unbound.

Agree, which is why I made it a file that you can add more sources to for yourself, and the script will keep it up to date too.
That being said, urlhaus is almost the perfect solution for me anyways. It is small and focused, ONLY currently live malware sites AND those found in the last 48 hours. With a quick 15 minute update, it protects you quickly from new sites found, and I checked, the RPZ file has updates from today, so it is up to date every 5 minutes.

Then I use https://github.com/mitchellkrogza/The-Big-List-of-Hacked-Malware-Web-Sites in my gen_adblock list. It includes the longer term items, but only updated nightly, as they don't change as often.

I think that makes a good mix.

-- edit ---

Good presentation of the benefits of DNS Firewall:
https://www.first.org/resources/papers/kathmandu2018/11-SumonSaha-DNS-Firewall-with-RPZ-bdcert.pdf

This is also a benefit of diversion if you choose sources with malware sites.
 
Agree. if you check out the dev branch you will see I have made this into a more fully-fledged script with install/uninstall and download commands. I plan to merge this into the master once I can review it with @Martineau. But with this format it follows the exact same pattern as unbound_stats.sh, so install/uninstall and it will keep up to date automatically and keep working after reboot.
Updated BETA v3.02 to call your rewritten DNS Firewall script API functions
Code:
e  = Exit Script

A:Option ==> firewall dev

Do you want to enable DNS Firewall?

    Reply 'y' or press [Enter]  to skip
y
    unbound_rpz.sh downloaded successfully Github 'dev/development' branch

Attempting to Download 1 of 1 from https://urlhaus.abuse.ch/downloads/rpz/.
######################################################################## 100.0%
Installed.

    unbound DNS Firewall ENABLED

unbound-checkconf: no errors in /opt/var/lib/unbound/unbound.conf

 Shutting down unbound...              done.
 Starting unbound...              done.
 
Last edited:

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top