Installing Unbound
for Pi-Hole on the
Raspberry Pi
by Emmet Updated Jun 05, 2023
Beginner Network
In this tutorial, we will be showing you how to
install and configure Unbound for Pi-Hole on
your Raspberry Pi.
Unbound is what is called a recursive DNS
server and is a way of improving your privacy
when browsing the internet.
Simply put, a recursive DNS server such as
Unbound calls the DNS root servers directly
and then recursively follows the path until it
resolves to an IP address your Raspberry Pi can
connect to.
This differs from a normal DNS service in which
Pi-Hole and your Raspberry Pi will send the
entire path to a service such as Cloudflare and
then accept the resolved IP Address it returns.
The advantage of using Unbound on your
Raspberry Pi is that it will greatly improve your
privacy as you don’t have to trust a third-party
service not to log the websites you are visiting.
A drawback to using a recursive DNS server
like Unbound is that DNS requests can take
considerably longer to complete as it needs to
traverse a path. After a while, though, the
speeds will improve significantly as both Pi-
Hole and Unbound caches these requests.
Additionally, using something like Unbound
does not prevent your ISP from monitoring your
DNS requests. If you want an alternative that
offers more privacy, try out DNS-Over-HTTPS.
However, this means you have to place all of
your trust in your DNS provider.
Please note to follow this tutorial, you will need
to have Pi-Hole set up on your Raspberry Pi.
Equipment
Below, you can find a list of the equipment we
used when installing and setting up Unbound
on the Raspberry Pi.
Recommended
Raspberry Pi
Micro SD Card
Power Supply
Ethernet Cable or Wi-Fi
Optional
Raspberry Pi Case
USB Mouse
USB Keyboard
HDMI Cable
Monitor
Installing and Setting Up
Unbound on your
Raspberry Pi
Over the next few steps, we will show you how
to install the Unbound DNS service to your
Raspberry Pi. We will then show you how to
configure it so your Pi-Hole installation can
interact with it.
Installing Unbound
1. Before installing Unbound on your
Raspberry Pi, you will want to perform an
update and upgrade.
Run the command below to update the
package list and upgrade out-of-date
packages.
Terminal $ Copy
sudo apt update
sudo apt upgrade
2. Once the package list completes, we can
install Unbound using the following command.
This command will install Unbound from the
default packages repositories.
Terminal $ Copy
sudo apt install unbound
If you see an error during installation, don’t
worry; that will be solved over the next few
steps.
Configuring Unbound on your
Raspberry Pi for Pi-Hole
3. With the recursive DNS resolver installed,
we can now write a configuration for Pi-Hole.
This config file will define the ports and
interface Unbound will operate on.
To begin writing this file, use the command
below within the terminal.
Terminal $ Copy
sudo nano /etc/unbound/unbound.conf.
4. Now that the file is open for editing, you will
want to type in the following lines.
These lines configure Unbound on your
Raspberry Pi to only listen to queries from Pi-
Hole. Additionally, it will also enable several
security and privacy improvements.
Add > Copy
server:
# If no logfile is specified, sy
# logfile: "/var/log/unbound/unb
verbosity: 0
interface: 127.0.0.1
port: 5335
do-ip4: yes
do-udp: yes
do-tcp: yes
# May be set to yes if you have
do-ip6: no
# You want to leave this to no u
# Terredo tunnels your web brows
prefer-ip6: no
# Use this only when you downloa
# If you use the default dns-roo
#root-hints: "/var/lib/unbound/r
# Trust glue only if it is withi
harden-glue: yes
# Require DNSSEC data for trust-
harden-dnssec-stripped: yes
# Don't use Capitalization rando
# see https://discourse.pi-hole.
use-caps-for-id: no
# Reduce EDNS reassembly buffer
# IP fragmentation is unreliable
# transmission failures when lar
# when fragmentation does work,
# possible to spoof parts of a f
# detection at the receiving end
# >>> Defragmenting DNS - Determ
# by Axel Koolhaas, and Tjeerd S
# in collaboration with NLnet La
# the RIPE Atlas probes and the
# IPv4 and IPv6 and in different
# be configured to limit DNS mes
# trigger fragmentation on typic
# from UDP to TCP when a DNS res
# buffer size. This value has al
edns-buffer-size: 1232
# Perform prefetching of close t
# This only applies to domains t
prefetch: yes
# One thread should be sufficien
num-threads: 1
# Ensure kernel buffer is large
so-rcvbuf: 1m
# Ensure privacy of local IP ran
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10
5. If you happen to have an IPv6 address then
before you save you should make one
adjustment to this file.
First, find the following line in the file. This line
currently disables any IPv6 functionality of
Unbound on your Raspberry Pi
Find > Copy
do-ip6: no
To activate IPv6 support, replace “ no ” with “
yes “.
Replace With > Copy
do-ip6: yes
6. Once you have made changes to Unbound’s
configuration, you can save and quit.
If you are using nano, all you need to do is
press CTRL + X , followed by Y , then the
ENTER key.
Setting the EDNS Packet Limit
for DNSMASQ
7. Our next step is to ensure that Pi Hole’s
faster-than-light (FTL) daemon adheres to the
“ edns-packet-max ” limit we set in Rebound.
To set this, we need to write a config file within
the “ /etc/dnsmasq.d ” directory by using the
command below.
Terminal $ Copy
sudo nano /etc/dnsmasq.d/99-edns.con
8. You will want to add the following line within
this file.
Add > Copy
edns-packet-max=1232
9. With the line added, you can save and quit
by pressing CTRL + X , followed by Y , and
then the ENTER key.
Disabling Resoltconf.conf Entry
for Unbound
10. For those running Raspberry Pi OS
Bullseye and newer, you must disable the “
Unbound resolvconf ” service that is
automatically created during installation.
To disable the “ Unbound resolvconf ” service,
use the following command in the terminal.
Terminal $ Copy
