Pi-hole on its own does not encrypt the DNS traffic to the upstream servers. To ensure the traffic is encrypted we use Unbound. Unbound is a recursive DNS server with caching. Unbound supports DNS over TLS and newer versions of Unbound support DNS over HTTPS as well but as of now that version is not available in all Linux distros and hence will be using DoT for this wiki.
Installing Pihole
Pi-hole has a simple bash script which guides you with the installation process.
curl -sSL https://install.pi-hole.net | bash
Follow the on-screen Instructions and complete the setup. Now we will move onto installation of Unbound.
Installing Unbound
Install the unbound package with the help of your package manager, for Debian and Ubuntu users the command is:
sudo apt update
sudo apt install unbound -y
You will get an error that unbound has failed to start. This is completely normal as there is no config file present.
Configuring Unbound
Unbound can be configured by adding a config file in the ‘/etc/unbound/unbound.conf.d’ folder. I have made a config which uses Cloudflare’s DNS as upstream using DoT with both IPv4 and IPv6 support. Make a file with any name say cf.conf and add the following into it.
server:
access-control: 127.0.0.0/8 allow
cache-max-ttl: 14400
cache-min-ttl: 600
do-tcp: yes
hide-identity: yes
hide-version: yes
interface: 127.0.0.1
minimal-responses: yes
prefetch: yes
qname-minimisation: yes
rrset-roundrobin: yes
ssl-upstream: yes
use-caps-for-id: yes
verbosity: 1
port: 5335
#
forward-zone:
name: "."
forward-addr: 1.1.1.1@853
forward-addr: 1.0.0.1@853
forward-addr: 2606:4700:4700::1111@853
forward-addr: 2606:4700:4700::1001@853
forward-ssl-upstream: yes
To make sure unbound starts on boot we run this command. Also restart unbound for our changes to take affect.
sudo systemctl enable unbound
sudo systemctl restart unbound
To verify that unbound works run the following commands :
dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335
dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335
The first one should return SERVFAIL and the second one should return NOERROR.
Now go to the admin page of Pi-hole and go to DNS settings and uncheck all the upstream DNS Servers. Under Custom add the following:
127.0.0.1#5335
And you are done! Now enjoy Ad-Blocking with DNS protection as well.