From 563c2edc5b1e4221d76598e9c06930d113a8da53 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Wed, 2 Aug 2023 09:28:05 +0200 Subject: [PATCH] fix(network): Conflicting port-names in DNS-deployment --- infra/net-aux/config/unbound/unbound.conf | 8 +- infra/net-aux/deployment.yaml | 6 +- infra/net-aux/service.yaml | 33 ++++- infra/pi-hole/config/unbound/unbound.conf | 145 ++++++++++++++-------- infra/pi-hole/deployment.yaml | 6 +- 5 files changed, 134 insertions(+), 64 deletions(-) diff --git a/infra/net-aux/config/unbound/unbound.conf b/infra/net-aux/config/unbound/unbound.conf index 96ef982..bdc2461 100644 --- a/infra/net-aux/config/unbound/unbound.conf +++ b/infra/net-aux/config/unbound/unbound.conf @@ -1,6 +1,6 @@ server: # See https://github.com/MatthewVance/unbound-docker/blob/master/unbound.conf for details - interface: 127.0.0.1 + interface: 0.0.0.0 port: 5335 cache-max-ttl: 86400 @@ -21,10 +21,10 @@ server: log-local-actions: no log-queries: no log-replies: no - log-servfail: no + log-servfail: yes #logfile: /opt/unbound/etc/unbound/unbound.log - verbosity: 1 + verbosity: 2 infra-cache-slabs: 4 incoming-num-tcp: 10 @@ -107,7 +107,9 @@ server: use-caps-for-id: no val-clean-additional: yes + include: /opt/unbound/etc/unbound/a-records.conf include: /opt/unbound/etc/unbound/srv-records.conf + remote-control: control-enable: no diff --git a/infra/net-aux/deployment.yaml b/infra/net-aux/deployment.yaml index 25c9a21..2375c51 100644 --- a/infra/net-aux/deployment.yaml +++ b/infra/net-aux/deployment.yaml @@ -29,10 +29,10 @@ spec: image: mvance/unbound:1.17.1 imagePullPolicy: IfNotPresent ports: - - name: dns-tcp + - name: unbound-dns-tcp containerPort: 5335 protocol: TCP - - name: dns-udp + - name: unbound-dns-udp containerPort: 5335 protocol: UDP startupProbe: @@ -52,7 +52,7 @@ spec: subPath: unbound.conf - name: pi-hole image: pihole/pihole:2023.05.2 - imagePullPolicy: IfNotPresent + imagePullPolicy: Always envFrom: - configMapRef: name: pi-hole-env diff --git a/infra/net-aux/service.yaml b/infra/net-aux/service.yaml index b87439b..b16fd19 100644 --- a/infra/net-aux/service.yaml +++ b/infra/net-aux/service.yaml @@ -3,12 +3,12 @@ kind: Service apiVersion: v1 metadata: name: pi-hole-dns-udp - namespace: pi-hole + namespace: net-aux annotations: metallb.universe.tf/allow-shared-ip: net-aux spec: selector: - app: pi-hole + app: net-aux ports: - name: dns-udp port: 53 @@ -20,12 +20,12 @@ kind: Service apiVersion: v1 metadata: name: pi-hole-dns-tcp - namespace: pi-hole + namespace: net-aux annotations: metallb.universe.tf/allow-shared-ip: net-aux spec: selector: - app: pi-hole + app: net-aux ports: - name: dns-tcp port: 53 @@ -37,12 +37,12 @@ kind: Service apiVersion: v1 metadata: name: pi-hole-web - namespace: pi-hole + namespace: net-aux annotations: metallb.universe.tf/allow-shared-ip: net-aux spec: selector: - app: pi-hole + app: net-aux ports: - name: http port: 80 @@ -51,3 +51,24 @@ spec: port: 443 targetPort: https type: LoadBalancer +--- +kind: Service +apiVersion: v1 +metadata: + name: unbound-dns + namespace: net-aux + annotations: + metallb.universe.tf/allow-shared-ip: net-aux +spec: + selector: + app: net-aux + ports: + - name: unbound-dns-tcp + port: 5335 + protocol: TCP + targetPort: unbound-dns-tcp + - name: unbound-dns-udp + port: 5335 + protocol: UDP + targetPort: unbound-dns-udp + type: LoadBalancer diff --git a/infra/pi-hole/config/unbound/unbound.conf b/infra/pi-hole/config/unbound/unbound.conf index 397deeb..0885916 100644 --- a/infra/pi-hole/config/unbound/unbound.conf +++ b/infra/pi-hole/config/unbound/unbound.conf @@ -1,69 +1,116 @@ server: - # If no logfile is specified, syslog is used - # logfile: "/var/log/unbound/unbound.log" - verbosity: 0 - - interface: 127.0.0.1 + # See https://github.com/MatthewVance/unbound-docker/blob/master/unbound.conf for details + interface: 0.0.0.0 port: 5335 - do-ip4: yes - do-udp: yes - do-tcp: yes - # May be set to yes if you have IPv6 connectivity - do-ip6: no + cache-max-ttl: 86400 + cache-min-ttl: 300 - # You want to leave this to no unless you have *native* IPv6. With 6to4 and - # Terredo tunnels your web browser should favor IPv4 for the same reasons - prefer-ip6: no - - # Use this only when you downloaded the list of primary root servers! - # If you use the default dns-root-data package, unbound will find it automatically + directory: "/opt/unbound/etc/unbound" root-hints: "/opt/unbound/etc/unbound/root.hints" - # Trust glue only if it is within the server's authority - harden-glue: yes + do-ip4: yes + do-ip6: yes + prefer-ip6: no + do-tcp: yes + do-udp: yes - # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS - harden-dnssec-stripped: yes - - # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes - # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details - use-caps-for-id: no - - # Reduce EDNS reassembly buffer size. - # IP fragmentation is unreliable on the Internet today, and can cause - # transmission failures when large DNS messages are sent via UDP. Even - # when fragmentation does work, it may not be secure; it is theoretically - # possible to spoof parts of a fragmented DNS message, without easy - # detection at the receiving end. Recently, there was an excellent study - # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<< - # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/) - # in collaboration with NLnet Labs explored DNS using real world data from the - # the RIPE Atlas probes and the researchers suggested different values for - # IPv4 and IPv6 and in different scenarios. They advise that servers should - # be configured to limit DNS messages sent over UDP to a size that will not - # trigger fragmentation on typical network links. DNS servers can switch - # from UDP to TCP when a DNS response is too big to fit in this limited - # buffer size. This value has also been suggested in DNS Flag Day 2020. edns-buffer-size: 1232 + rrset-roundrobin: yes + username: "_unbound" + + log-local-actions: no + log-queries: no + log-replies: no + log-servfail: yes + + #logfile: /opt/unbound/etc/unbound/unbound.log + verbosity: 2 + + infra-cache-slabs: 4 + incoming-num-tcp: 10 + key-cache-slabs: 4 + + msg-cache-size: 142768128 + msg-cache-slabs: 4 + + num-queries-per-thread: 4096 + num-threads: 3 + + outgoing-range: 8192 + + rrset-cache-size: 285536256 + rrset-cache-slabs: 4 + + minimal-responses: yes - # Perform prefetching of close to expired message cache entries - # This only applies to domains that have been frequently queried prefetch: yes + prefetch-key: yes - # One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1. - num-threads: 2 + serve-expired: yes - # Ensure kernel buffer is large enough to not lose messages in traffic spikes - so-rcvbuf: 1m + so-reuseport: yes - # Ensure privacy of local IP ranges + aggressive-nsec: yes + + delay-close: 10000 + + do-daemonize: no + + do-not-query-localhost: no + + neg-cache-size: 4M + + qname-minimisation: yes + + access-control: 127.0.0.1/32 allow + access-control: 192.168.0.0/16 allow + access-control: 172.16.0.0/12 allow + access-control: 10.0.0.0/8 allow + access-control: fc00::/7 allow + access-control: ::1/128 allow + + auto-trust-anchor-file: "var/root.key" + + chroot: "/opt/unbound/etc/unbound" + + deny-any: yes + + harden-algo-downgrade: yes + harden-below-nxdomain: yes + harden-dnssec-stripped: yes + harden-glue: yes + harden-large-queries: yes + harden-referral-path: no + harden-short-bufsize: yes + + hide-http-user-agent: no + hide-identity: yes + hide-version: yes + + http-user-agent: "DNS" + identity: "DNS" + + private-address: 10.0.0.0/8 + private-address: 172.16.0.0/12 private-address: 192.168.0.0/16 private-address: 169.254.0.0/16 - private-address: 172.16.0.0/12 - private-address: 10.0.0.0/8 private-address: fd00::/8 private-address: fe80::/10 + private-address: ::ffff:0:0/96 + + ratelimit: 1000 + + tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt + + unwanted-reply-threshold: 10000 + + use-caps-for-id: no + + val-clean-additional: yes + + include: /opt/unbound/etc/unbound/a-records.conf + include: /opt/unbound/etc/unbound/srv-records.conf remote-control: control-enable: no diff --git a/infra/pi-hole/deployment.yaml b/infra/pi-hole/deployment.yaml index b01ca53..4113cad 100644 --- a/infra/pi-hole/deployment.yaml +++ b/infra/pi-hole/deployment.yaml @@ -29,10 +29,10 @@ spec: image: mvance/unbound:1.17.1 imagePullPolicy: IfNotPresent ports: - - name: dns-tcp + - name: unbound-dns-tcp containerPort: 5335 protocol: TCP - - name: dns-udp + - name: unbound-dns-udp containerPort: 5335 protocol: UDP startupProbe: @@ -55,7 +55,7 @@ spec: subPath: root.hints - name: pi-hole image: pihole/pihole:2023.05.2 - imagePullPolicy: IfNotPresent + imagePullPolicy: Always envFrom: - configMapRef: name: pi-hole-env