Unbound in Docker with PiHole - Regain Your Privacy - Cybersecurity at Home
Vložit
- čas přidán 18. 08. 2024
- Use Unbound as a self-hosted recursive DNS resolver to help protect your online privacy. In this video I show you how to deploy unbound with PiHole (and optional VPN) in Docker. Cybersecurity at home!
Config Files: github.com/Jam...
Discord: / discord
00:00 - Introduction to Unbound / Recursive DNS
03:22 - Configuration Overview
13:20 - Docker Deployment
15:15 - Testing Configuration
17:20 - Outro - Věda a technologie
Thanks Jim, I have been watching your content for the last couple of weeks and I just wanted to say that it is absolutely brilliant!
Thanks, that's extremely kind
Thanks,
Finally someone who comes up with a detailled explanation why we are doing the things we are doing.
Great video.
Thanks for watching!
Great video! I'm a big fan of your work!!! Keep up the great work!!!
@@victordepta4069 thanks, that's much appreciated
Very useful and in depth. Exactly what I needed. I have struggled a lot setting it up the correct way and understanding the parameters. Great tutorial
Glad it was helpful!
Absolutely brilliant! I've been searching for this sort of content for the best part of 5 years! Definitely going to explore more of your videos!
Thanks, really appreciate the feedback 🙂
Great video! I ran pinhole years ago. I’m considering spinning up adGuard. I would love to see a comparison between the two
Great suggestion!
Nice now I can understand what I’ve been using for a while already 😂
Haha, great. Better late than never!
Thank you for the informative video. As with all your videos, you make a potentially complex topic very easy to understand and implement. I'm already utilising PiHole over a Cloudflare tunnel and I'm not too worried about the privacy concerns but the additional protection Unbound provides against DNS poisoning is interesting so I may look at switching.
Thanks, I put it in the camp of nice to have but not essential.
Thank you James, Great video about hosting the recursive server.
Thanks, appreciate the feedback.
thanks for your help again got it to work !
Awesome 😎
I've tried to use your configuration from the video, but it's not working correctly. The problem is with unbound.conf file and interface - this should be left at default 53, as you're already mapping it to 5053 from the container :)
looks like you've moved onto to using vs code, i love using it. good stuff as always.
Thanks. I think it works a lot better to demonstrate.
Great video, thank for posting!
You're welcome
A thorough and clear explanation as always. Is this something you move to kubernetes cluster or keep it portainer forever?
You could host in docker, swarm or Kubernetes. It's completely up to you. I'll likely deploy in Kubernetes.
Also, you don’t need to specify load balancing for a single container in traefik labels if the server port is already configured on a standard web port. Only if it’s something else like 9000, 8080, etc.
Hey, I am very curious. If privacy is the goal with Unbound why not use DNS over HTTPS to encrypt your DNS? Are there specific reasons you may want to use Unbound instead?
It's a balance. With DNS over HTTPS you're letting a 3rd party do the recursive part. This means they know everything. If you self host, non encrypted, it communicates with the authoritative servers directly, there's no caching and no 3rd party knows exactly what you're doing.
Obviously when you visit a site your ISP knows.
@@PNW-JTYep, and the same as when you then visit the site, ISP knows as it routes your traffic. It all is a trade-off, there cannot be a perfect solution.
Tip for anyone using a fresh installation ubuntu server (22.04 in my case): Disable systemd-resolved before trying this, it conflicts on port 53 and causes an error when running docker-compose
You can disable it by running these commands:
sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved
sudo reboot
Thanks for the commands.
What does systemd-resolved do? @frostiefops
@@user-gx3st2th8q I believe it is an internal dns server/resolver of sorts - thinking back it might not be such a great idea to disable it but my homelab seems to be running fine without it
Thanks very much!!
You're welcome
Hi Jim, thank you so much for this video... it was an entry into the rabbithole of pihole, unbound and docker for me.
After following your guide, I decided to set up two pihole containers on the same raspberry pi 4, so that I could have a DNS for my children (i.e. more restricted internet use), and one for everyone else. I ended up with a user-defined bridge (for the communication between the pihole containers and the unbound one); and the two pihole containers also on an ipvlan. This way only pihole is exposed to the LAN and it can't be circumvented by using the Unbound port 5053.
It also means that both pihole containers and the unbound container can listen on port 53 (i.e. no port mapping). I was wondering whether you'd considered this networking setup; and whether there are reasons not to use it? / The benefits of the port mappings on a bridge network that this video shows?
Seems fine to me. I'll be doing something similar when my kids are old enough to access the internet.
Hi Jim, why not using unbound on OPNsense and configure DoT with Cloudflare?
Using pfSense or OpnSense is a perfectly valid option, I simply didn't want to assume that everyone is using it.
You can absolutely use a Cloudflare Tunnel or a VPN if you want as per example. It depends who you want to know your requests, always a trade off.
On top I use ADHomeGuard on OPNsense.
@@Jims-Garage I talked about DNS over TLS with Cloudflare, not CF Tunnel or a VPN.
@@Glatze603 if you do it that way you're using unbound as a forwarder same as PiHole default setup. This way Cloudflare sees everything. Unbound is by design a recursive DNS firstly.
Thanks Jim!, could set this up in a Docker Swarm with replication and a way to still see all the individual clients? That would be (I think) the ultimate setup, in case one node fails the other one would pick it up or in case of upgrading one node.
Yes, that should be possible, same with kubernetes.
Hi jim. Need your help. I tried to install on my raspi pi, but so far no luck. I did update the unbound image source like yoy suggested. Can you make compose with no traefik?
@@nihoniumog5185 hey, delete the network and Traefik labels, add ports section. That will do it.
This might be my next project. I’ve tried pi hole a handful of times over the years but inevitably after a few months, my Internet slows to a crawl.
I’m gonna go back and watch your pole video and see if I can glean an answer as to why that is
Interesting, that's odd. Do you run out of space? I've never had that issue and have been using for about 6 years.
@@Jims-Garage maybe in the past it had been ran on a pi4 with a 16gb SD. I haven’t tried since I’ve been SATA booting my Pi’s
If you use opnsense skip the unbound part and just use the built in one. Does the same 😊
Agreed, makes sense. Just be sure to disable forwarding requests.
Excellent video as always, thank you so much for all your content, I am learning a lot. In my case, I use the OPNsense unbound, and have the other settings as you in PiHole, except that I also check the "Use Conditional Forwarding" and refer to the DCHP server IP, just at the end of the settings page, in order to get the hostnames instead of simple IPs in the logs. Am I doing smth wrong in terms of security? Thanks again
Thanks. No, that sounds fine. Just make sure you're not forwarding the DNS queries, otherwise it defeats one of the main benefits of self hosting it.
@@Jims-GarageI'm not sure about your concern. If executing a dig or nslookup to google, both return my pihole IP
You don’t need to change or expose any ports for unbound. Because the end user does not access unbound directly and you are routing from PiHole to Unbound over a docker network with their own IPs, port 53 is not in conflict.
Hello Jim
for a beginner, on rpi 4, Rpi OS - if i want to use your setup
for example i need to make 2 folders in for e.g. Documents
copy files for each unbound and pihole
for starting this containers, do i need any change in `volumes` section in .yml file?
Amend the volumes to whatever you want, mine are simply how I have it configured. Some are mandatory though for functionality.
Thanks, Jim for sharing and am new to this space, so I have a question how can I do the same installation on CasaOS container, I have installed pi-hole, and other apps(home assistant) running on CasaOS. if you could provide guides I would greatly appreciate it.
Sorry, I'm not sure. Perhaps ask in my Discord.
How do you use vscode on windows to create and edit docker conatiners on Linux machine ?
There's an SSH plugin that allows you remote.
Thanks Jim. Another supperb video. I am trying to implement in a QNAP NAS. As i have checked `prt :53 is used by service DNSMASQ.. I have disable it and use your installation .. All works, except some containers (crowdsec and others) that they haven't got dns service, so no internet inside dockers .. Anyone has tested in QNAP NAS ?
How to install this using unraid community applications ? Both pinhole and unbound and make them communicate with each other
I'm not sure, I've never used unraid I'm afraid.
Thanks Jim. I have moved to all Kubernetes, no more docker compose! how to do this in Kubernetes?
Hi Jim, great video. Are you sure your docker-compose.yml is correct? I kept getting service.pihole.environment variable must be mapped error. I had to remove the `-` in front of the environment variables or put `" "` around the variable to get around the error. After `docker compose up -d` I get the message `error response from daemon: network proxy not found` any idea what that is about? I can see in portainer that the bridge was created but the container were not created.
Proxy network is if you're using Traefik. Change it to whatever your proxy network is called (delete if not using)
@@Jims-Garage Hi Jim, thanks for the trouble shooting. I deleted all the Traefik stuff but didn't delete the proxy config which I have done now but I seem to have no luck with your docker file. Now I get the error `Error starting userland proxy: listen tcp4 0.0.0.0:53: bind: address already in use` but it is a brand new installation with only portainer running. I currently have pihole running already for couple of years but the combination with unbound sounds like a must have.
Nice, does unbound also works with adguard? I prefere it instead of pihole
I don't know but I imagine you can specify upstream DNS? If so, should be good to go.
Yes, I can confirm it works too!
Thanks for the video! Just a question, what's the difference/benefits of using this over cloudflare tunnels?
Not a great deal, but there are privacy and security benefits from hosting the recursive server yourself. It helps against Cloudflare knowing all of your DNS queries, plus protects you from DNS poisoning attacks.
@@Jims-Garage do you think it is possible to combine both approaches ? If cloudflare is down or as a load balancing or parallel requests?
@@batb6627 the reason you are using Cloudflare is for security, it's providing an encrypted tunnel to Cloudflare so only Cloudflare can see the DNS query.
Unbound is resolving the IP for you by contacting authoritative nameservers. The two things are disparate.
@@Jims-Garage okay, I get get it!
Thanks for your reply, I'm pretty sure it'll be helpful for others
Hi Jim - almost have this running, but as someone mentioned below a couple months ago, I'm getting the following error. Any ideas?
"Error starting userland proxy: listen tcp4 0.0.0.0:53: bind: address already in use"
If you're using Ubuntu you might need to apply the port 53 fix.
@@Jims-Garage is that documented on your Github site somewhere? Thanks for your help! 👌
How do you deploy Unbound with PiHole on CasaOS?
Sorry, I don't know. I don't use CasaOS
Why wouldn't you setup an LXC in Proxmox and just integrate Unbound with Pi-Hole?
You could. I prefer the security of VMs and flexibility of Docker though. 1 click for a full restore.
@@Jims-Garage Are you gonna do a video for this based on RKE2?
@@SpookyLurker I'll likely add the Kubernetes manifest files. I've already shown how to convert docker to Kubernetes
I have an error and as somebody who knows sweet FA about this stuff have no idea where to start.
Network docker-compose_dns_net Created 0.2s
Error response from daemon: network proxy not found
This after running sudo docker compose up -d. Please help........
Do you have Traefik? If so, amend proxy network to your Traefik network.
As mentioned in the video, if you're not using a proxy then delete the labels section and the proxy network
@@Jims-Garage No not running Traefik and as per your video I did remove the entire labels section. I see you have an empty proxy: line under the ipv4 address. Anything to do with it?
As a test I removed the proxy: line and it ran the container up without errors. Pihole is getting requests but not passing them to unbound.
@@e.colemantlpss6406 good, glad it's working. The proxy: value tells it to put it on the proxy network which is specified at the bottom of the compose file.
@@Jims-Garage It's not working :( I give up
@@e.colemantlpss6406 in what way wasn't it working?
Can you stop saying Umbound, its UNBOUND, LIKE UN)DER
Yes, I know what it is, English is my native language... I only hear Unbound, albeit I did have a cold at the time of recording.
Hi
I am new to docker world , After running the docker compose , I am getting below Error :
⠼ Network unbound_dns_net Created 0.3s
Error response from daemon: network proxy not found
Can someone help ?
Create the network (you can follow my Traefik video as mentioned), or change it to whatever network you want.