Unbound in Docker with PiHole - Regain Your Privacy - Cybersecurity at Home

  Рет қаралды 24,724

Jim's Garage

Jim's Garage

Күн бұрын

Use Unbound as a self-hosted recursive DNS resolver to help protect your online privacy. In this video I show you how to deploy unbound with PiHole (and optional VPN) in Docker. Cybersecurity at home!
Config Files: github.com/JamesTurland/JimsG...
Discord: / discord
00:00 - Introduction to Unbound / Recursive DNS
03:22 - Configuration Overview
13:20 - Docker Deployment
15:15 - Testing Configuration
17:20 - Outro

Пікірлер: 94
@agroleau04
@agroleau04 5 ай бұрын
Thanks Jim, I have been watching your content for the last couple of weeks and I just wanted to say that it is absolutely brilliant!
@Jims-Garage
@Jims-Garage 5 ай бұрын
Thanks, that's extremely kind
@iiilllii140
@iiilllii140 Ай бұрын
Thanks, Finally someone who comes up with a detailled explanation why we are doing the things we are doing. Great video.
@Jims-Garage
@Jims-Garage Ай бұрын
Thanks for watching!
@peterjackson9546
@peterjackson9546 4 ай бұрын
Absolutely brilliant! I've been searching for this sort of content for the best part of 5 years! Definitely going to explore more of your videos!
@Jims-Garage
@Jims-Garage 4 ай бұрын
Thanks, really appreciate the feedback 🙂
@Net-Extension
@Net-Extension 5 ай бұрын
Very useful and in depth. Exactly what I needed. I have struggled a lot setting it up the correct way and understanding the parameters. Great tutorial
@Jims-Garage
@Jims-Garage 5 ай бұрын
Glad it was helpful!
@markandrow4010
@markandrow4010 5 ай бұрын
Thank you James, Great video about hosting the recursive server.
@Jims-Garage
@Jims-Garage 5 ай бұрын
Thanks, appreciate the feedback.
@brahman88
@brahman88 5 ай бұрын
Thank you for the informative video. As with all your videos, you make a potentially complex topic very easy to understand and implement. I'm already utilising PiHole over a Cloudflare tunnel and I'm not too worried about the privacy concerns but the additional protection Unbound provides against DNS poisoning is interesting so I may look at switching.
@Jims-Garage
@Jims-Garage 5 ай бұрын
Thanks, I put it in the camp of nice to have but not essential.
@-rm-rf
@-rm-rf 5 ай бұрын
Nice now I can understand what I’ve been using for a while already 😂
@Jims-Garage
@Jims-Garage 5 ай бұрын
Haha, great. Better late than never!
@thespencerowen
@thespencerowen 5 ай бұрын
Great video! I ran pinhole years ago. I’m considering spinning up adGuard. I would love to see a comparison between the two
@Jims-Garage
@Jims-Garage 5 ай бұрын
Great suggestion!
@dbishop9085
@dbishop9085 5 ай бұрын
Great video, thank for posting!
@Jims-Garage
@Jims-Garage 5 ай бұрын
You're welcome
@romayojr
@romayojr 5 ай бұрын
looks like you've moved onto to using vs code, i love using it. good stuff as always.
@Jims-Garage
@Jims-Garage 5 ай бұрын
Thanks. I think it works a lot better to demonstrate.
@DeepakNaidu
@DeepakNaidu 5 ай бұрын
A thorough and clear explanation as always. Is this something you move to kubernetes cluster or keep it portainer forever?
@Jims-Garage
@Jims-Garage 5 ай бұрын
You could host in docker, swarm or Kubernetes. It's completely up to you. I'll likely deploy in Kubernetes.
@frostiefops
@frostiefops 3 ай бұрын
Tip for anyone using a fresh installation ubuntu server (22.04 in my case): Disable systemd-resolved before trying this, it conflicts on port 53 and causes an error when running docker-compose You can disable it by running these commands: sudo systemctl stop systemd-resolved sudo systemctl disable systemd-resolved sudo reboot
@Jims-Garage
@Jims-Garage 3 ай бұрын
Thanks for the commands.
@user-gx3st2th8q
@user-gx3st2th8q 2 ай бұрын
What does systemd-resolved do? @frostiefops
@frostiefops
@frostiefops 2 ай бұрын
@@user-gx3st2th8q I believe it is an internal dns server/resolver of sorts - thinking back it might not be such a great idea to disable it but my homelab seems to be running fine without it
@davidwestra8181
@davidwestra8181 3 ай бұрын
Also, you don’t need to specify load balancing for a single container in traefik labels if the server port is already configured on a standard web port. Only if it’s something else like 9000, 8080, etc.
@zigotica
@zigotica 5 ай бұрын
Excellent video as always, thank you so much for all your content, I am learning a lot. In my case, I use the OPNsense unbound, and have the other settings as you in PiHole, except that I also check the "Use Conditional Forwarding" and refer to the DCHP server IP, just at the end of the settings page, in order to get the hostnames instead of simple IPs in the logs. Am I doing smth wrong in terms of security? Thanks again
@Jims-Garage
@Jims-Garage 5 ай бұрын
Thanks. No, that sounds fine. Just make sure you're not forwarding the DNS queries, otherwise it defeats one of the main benefits of self hosting it.
@zigotica
@zigotica 5 ай бұрын
@@Jims-GarageI'm not sure about your concern. If executing a dig or nslookup to google, both return my pihole IP
@epochphilosophy
@epochphilosophy 5 ай бұрын
Hey, I am very curious. If privacy is the goal with Unbound why not use DNS over HTTPS to encrypt your DNS? Are there specific reasons you may want to use Unbound instead?
@Jims-Garage
@Jims-Garage 5 ай бұрын
It's a balance. With DNS over HTTPS you're letting a 3rd party do the recursive part. This means they know everything. If you self host, non encrypted, it communicates with the authoritative servers directly, there's no caching and no 3rd party knows exactly what you're doing. Obviously when you visit a site your ISP knows.
@Jims-Garage
@Jims-Garage 5 ай бұрын
@@PNW-JTYep, and the same as when you then visit the site, ISP knows as it routes your traffic. It all is a trade-off, there cannot be a perfect solution.
@franciscogomez2088
@franciscogomez2088 5 ай бұрын
Thanks Jim!, could set this up in a Docker Swarm with replication and a way to still see all the individual clients? That would be (I think) the ultimate setup, in case one node fails the other one would pick it up or in case of upgrading one node.
@Jims-Garage
@Jims-Garage 5 ай бұрын
Yes, that should be possible, same with kubernetes.
@philiprichardson7447
@philiprichardson7447 2 ай бұрын
Hi Jim, thank you so much for this video... it was an entry into the rabbithole of pihole, unbound and docker for me. After following your guide, I decided to set up two pihole containers on the same raspberry pi 4, so that I could have a DNS for my children (i.e. more restricted internet use), and one for everyone else. I ended up with a user-defined bridge (for the communication between the pihole containers and the unbound one); and the two pihole containers also on an ipvlan. This way only pihole is exposed to the LAN and it can't be circumvented by using the Unbound port 5053. It also means that both pihole containers and the unbound container can listen on port 53 (i.e. no port mapping). I was wondering whether you'd considered this networking setup; and whether there are reasons not to use it? / The benefits of the port mappings on a bridge network that this video shows?
@Jims-Garage
@Jims-Garage 2 ай бұрын
Seems fine to me. I'll be doing something similar when my kids are old enough to access the internet.
@andresrevilla7932
@andresrevilla7932 4 ай бұрын
Thanks Jim. Another supperb video. I am trying to implement in a QNAP NAS. As i have checked `prt :53 is used by service DNSMASQ.. I have disable it and use your installation .. All works, except some containers (crowdsec and others) that they haven't got dns service, so no internet inside dockers .. Anyone has tested in QNAP NAS ?
@ff34jmr
@ff34jmr 5 ай бұрын
If you use opnsense skip the unbound part and just use the built in one. Does the same 😊
@Jims-Garage
@Jims-Garage 5 ай бұрын
Agreed, makes sense. Just be sure to disable forwarding requests.
@xandev4s
@xandev4s 22 күн бұрын
I've tried to use your configuration from the video, but it's not working correctly. The problem is with unbound.conf file and interface - this should be left at default 53, as you're already mapping it to 5053 from the container :)
@joydavid1759
@joydavid1759 3 ай бұрын
Thanks, Jim for sharing and am new to this space, so I have a question how can I do the same installation on CasaOS container, I have installed pi-hole, and other apps(home assistant) running on CasaOS. if you could provide guides I would greatly appreciate it.
@Jims-Garage
@Jims-Garage 3 ай бұрын
Sorry, I'm not sure. Perhaps ask in my Discord.
@davidwestra8181
@davidwestra8181 4 ай бұрын
You don’t need to change or expose any ports for unbound. Because the end user does not access unbound directly and you are routing from PiHole to Unbound over a docker network with their own IPs, port 53 is not in conflict.
@JohnWeland
@JohnWeland 5 ай бұрын
This might be my next project. I’ve tried pi hole a handful of times over the years but inevitably after a few months, my Internet slows to a crawl. I’m gonna go back and watch your pole video and see if I can glean an answer as to why that is
@Jims-Garage
@Jims-Garage 5 ай бұрын
Interesting, that's odd. Do you run out of space? I've never had that issue and have been using for about 6 years.
@JohnWeland
@JohnWeland 5 ай бұрын
@@Jims-Garage maybe in the past it had been ran on a pi4 with a 16gb SD. I haven’t tried since I’ve been SATA booting my Pi’s
@RaviKumar-mj3gs
@RaviKumar-mj3gs 4 ай бұрын
Thanks Jim. I have moved to all Kubernetes, no more docker compose! how to do this in Kubernetes?
@igihara2662
@igihara2662 2 ай бұрын
Hello Jim for a beginner, on rpi 4, Rpi OS - if i want to use your setup for example i need to make 2 folders in for e.g. Documents copy files for each unbound and pihole for starting this containers, do i need any change in `volumes` section in .yml file?
@Jims-Garage
@Jims-Garage 2 ай бұрын
Amend the volumes to whatever you want, mine are simply how I have it configured. Some are mandatory though for functionality.
@batb6627
@batb6627 5 ай бұрын
Thanks for the video! Just a question, what's the difference/benefits of using this over cloudflare tunnels?
@Jims-Garage
@Jims-Garage 5 ай бұрын
Not a great deal, but there are privacy and security benefits from hosting the recursive server yourself. It helps against Cloudflare knowing all of your DNS queries, plus protects you from DNS poisoning attacks.
@batb6627
@batb6627 5 ай бұрын
@@Jims-Garage do you think it is possible to combine both approaches ? If cloudflare is down or as a load balancing or parallel requests?
@Jims-Garage
@Jims-Garage 5 ай бұрын
@@batb6627 the reason you are using Cloudflare is for security, it's providing an encrypted tunnel to Cloudflare so only Cloudflare can see the DNS query. Unbound is resolving the IP for you by contacting authoritative nameservers. The two things are disparate.
@batb6627
@batb6627 5 ай бұрын
@@Jims-Garage okay, I get get it! Thanks for your reply, I'm pretty sure it'll be helpful for others
@Glatze603
@Glatze603 5 ай бұрын
Hi Jim, why not using unbound on OPNsense and configure DoT with Cloudflare?
@Jims-Garage
@Jims-Garage 5 ай бұрын
Using pfSense or OpnSense is a perfectly valid option, I simply didn't want to assume that everyone is using it. You can absolutely use a Cloudflare Tunnel or a VPN if you want as per example. It depends who you want to know your requests, always a trade off.
@Glatze603
@Glatze603 5 ай бұрын
On top I use ADHomeGuard on OPNsense.
@Glatze603
@Glatze603 3 ай бұрын
@@Jims-Garage I talked about DNS over TLS with Cloudflare, not CF Tunnel or a VPN.
@Jims-Garage
@Jims-Garage 3 ай бұрын
@@Glatze603 if you do it that way you're using unbound as a forwarder same as PiHole default setup. This way Cloudflare sees everything. Unbound is by design a recursive DNS firstly.
@martinzipfel7843
@martinzipfel7843 5 ай бұрын
Hi Jim, great video. Are you sure your docker-compose.yml is correct? I kept getting service.pihole.environment variable must be mapped error. I had to remove the `-` in front of the environment variables or put `" "` around the variable to get around the error. After `docker compose up -d` I get the message `error response from daemon: network proxy not found` any idea what that is about? I can see in portainer that the bridge was created but the container were not created.
@Jims-Garage
@Jims-Garage 5 ай бұрын
Proxy network is if you're using Traefik. Change it to whatever your proxy network is called (delete if not using)
@martinzipfel7843
@martinzipfel7843 5 ай бұрын
@@Jims-Garage Hi Jim, thanks for the trouble shooting. I deleted all the Traefik stuff but didn't delete the proxy config which I have done now but I seem to have no luck with your docker file. Now I get the error `Error starting userland proxy: listen tcp4 0.0.0.0:53: bind: address already in use` but it is a brand new installation with only portainer running. I currently have pihole running already for couple of years but the combination with unbound sounds like a must have.
@monish05m
@monish05m 5 ай бұрын
How do you use vscode on windows to create and edit docker conatiners on Linux machine ?
@Jims-Garage
@Jims-Garage 5 ай бұрын
There's an SSH plugin that allows you remote.
@drmetroyt
@drmetroyt 5 ай бұрын
How to install this using unraid community applications ? Both pinhole and unbound and make them communicate with each other
@Jims-Garage
@Jims-Garage 5 ай бұрын
I'm not sure, I've never used unraid I'm afraid.
@scubeedu2
@scubeedu2 2 ай бұрын
Hi Jim - almost have this running, but as someone mentioned below a couple months ago, I'm getting the following error. Any ideas? "Error starting userland proxy: listen tcp4 0.0.0.0:53: bind: address already in use"
@Jims-Garage
@Jims-Garage 2 ай бұрын
If you're using Ubuntu you might need to apply the port 53 fix.
@scubeedu2
@scubeedu2 2 ай бұрын
@@Jims-Garage is that documented on your Github site somewhere? Thanks for your help! 👌
@e.colemantlpss6406
@e.colemantlpss6406 5 ай бұрын
I have an error and as somebody who knows sweet FA about this stuff have no idea where to start. Network docker-compose_dns_net Created 0.2s Error response from daemon: network proxy not found This after running sudo docker compose up -d. Please help........
@Jims-Garage
@Jims-Garage 5 ай бұрын
Do you have Traefik? If so, amend proxy network to your Traefik network. As mentioned in the video, if you're not using a proxy then delete the labels section and the proxy network
@e.colemantlpss6406
@e.colemantlpss6406 5 ай бұрын
@@Jims-Garage No not running Traefik and as per your video I did remove the entire labels section. I see you have an empty proxy: line under the ipv4 address. Anything to do with it? As a test I removed the proxy: line and it ran the container up without errors. Pihole is getting requests but not passing them to unbound.
@Jims-Garage
@Jims-Garage 5 ай бұрын
@@e.colemantlpss6406 good, glad it's working. The proxy: value tells it to put it on the proxy network which is specified at the bottom of the compose file.
@e.colemantlpss6406
@e.colemantlpss6406 5 ай бұрын
@@Jims-Garage It's not working :( I give up
@Jims-Garage
@Jims-Garage 5 ай бұрын
@@e.colemantlpss6406 in what way wasn't it working?
@SpookyLurker
@SpookyLurker 5 ай бұрын
Why wouldn't you setup an LXC in Proxmox and just integrate Unbound with Pi-Hole?
@Jims-Garage
@Jims-Garage 5 ай бұрын
You could. I prefer the security of VMs and flexibility of Docker though. 1 click for a full restore.
@SpookyLurker
@SpookyLurker 5 ай бұрын
@@Jims-Garage Are you gonna do a video for this based on RKE2?
@Jims-Garage
@Jims-Garage 5 ай бұрын
@@SpookyLurker I'll likely add the Kubernetes manifest files. I've already shown how to convert docker to Kubernetes
@luigitech3169
@luigitech3169 5 ай бұрын
Nice, does unbound also works with adguard? I prefere it instead of pihole
@Jims-Garage
@Jims-Garage 5 ай бұрын
I don't know but I imagine you can specify upstream DNS? If so, should be good to go.
@batb6627
@batb6627 5 ай бұрын
Yes, I can confirm it works too!
@andrewtegala
@andrewtegala 3 ай бұрын
How do you deploy Unbound with PiHole on CasaOS?
@Jims-Garage
@Jims-Garage 3 ай бұрын
Sorry, I don't know. I don't use CasaOS
@streamx2
@streamx2 3 ай бұрын
Can you stop saying Umbound, its UNBOUND, LIKE UN)DER
@Jims-Garage
@Jims-Garage 3 ай бұрын
Yes, I know what it is, English is my native language... I only hear Unbound, albeit I did have a cold at the time of recording.
@rutvijpatil2032
@rutvijpatil2032 3 ай бұрын
Hi I am new to docker world , After running the docker compose , I am getting below Error : ⠼ Network unbound_dns_net Created 0.3s Error response from daemon: network proxy not found Can someone help ?
@Jims-Garage
@Jims-Garage 3 ай бұрын
Create the network (you can follow my Traefik video as mentioned), or change it to whatever network you want.
Secure Your Cluster With Network Policies
10:43
Jim's Garage
Рет қаралды 2,6 М.
⬅️🤔➡️
00:31
Celine Dept
Рет қаралды 50 МЛН
Can You Draw A PERFECTLY Dotted Line?
00:55
Stokes Twins
Рет қаралды 73 МЛН
Khóa ly biệt
01:00
Đào Nguyễn Ánh - Hữu Hưng
Рет қаралды 20 МЛН
We Got Expelled From Scholl After This...
00:10
Jojo Sim
Рет қаралды 72 МЛН
Best DNS Server for Home lab - Pihole Unbound configuration!
13:13
VirtualizationHowto
Рет қаралды 83 М.
Keep Hackers Out with Crowdsec Now!
20:54
Jim's Garage
Рет қаралды 15 М.
Stop paying for Google Photos! Self host on your own PC!!
10:59
Thomas Wilde
Рет қаралды 1,1 М.
Don’t run Proxmox without these settings!
25:45
Christian Lempa
Рет қаралды 117 М.
Pi-Hole Local DNS Configuration
13:55
Toasty Answers
Рет қаралды 84 М.
Host Your Own Encrypted DNS Server
24:21
Mental Outlaw
Рет қаралды 116 М.
Игровой Комп с Авито за 4500р
1:00
ЖЕЛЕЗНЫЙ КОРОЛЬ
Рет қаралды 1,2 МЛН
В России ускорили интернет в 1000 раз
0:18
Короче, новости
Рет қаралды 411 М.
SSD с кулером и скоростью 1 ГБ/с
0:47
Rozetked
Рет қаралды 592 М.