Setting Up an Internal DNS Server Using NSD and Unbound

Managing multiple services within a LAN environment can become challenging, especially when keeping track of which services run on which servers. Using domain names instead of IP addresses simplifies access and allows for easier migration of services without modifying bookmarks or configurations.

An internal DNS server is set up to resolve domain names within the local network. While BIND is a common choice, this setup uses NSD (for authoritative DNS functionality) and Unbound (for DNS caching functionality) on Arch Linux.

NSD (Authoritative DNS Server) Setup

#

Installing NSD

#

Execute the following command to install NSD:

sudo pacman -S nsd

Initial Configuration

#

Edit /etc/nsd/nsd.conf with the following settings. Since NSD is used alongside Unbound, port 53530 is set to avoid conflicts.

server:
    ip-address: 127.0.0.1
    do-ip6: no
    port: 53530
    zonesdir: "/etc/nsd/zone"
    hide-version: yes
    identity: "Home network authoritative DNS"

zone:
    name: "mkt3.dev"
    zonefile: "mkt3.dev.zone"

Zone File Configuration

#

Edit the zone file specified in nsd.conf (e.g., mkt3.dev.zone) as follows:

$TTL 86400
@ IN SOA ns.mkt3.dev. postmaster.mkt3.dev. (
        2018071301 ; Serial
        28800 ; Refresh
        14400 ; Retry
        3600000 ; Expire
        86400 ) ; Minimum
@  IN NS ns.mkt3.dev.
ns IN A  192.168.10.10

Starting and Enabling NSD

#

Start the NSD service:

sudo systemctl start nsd.service

Enable NSD at boot:

sudo systemctl enable nsd.service

Verifying NSD Operation

#

Check if the internal domain resolves correctly:

drill @127.0.0.1 -p 53530 ns.mkt3.dev

Unbound (Caching DNS Server) Setup

#

Installing Unbound

#

Execute the following command to install Unbound:

sudo pacman -S unbound

Initial Configuration

#

Edit /etc/unbound/unbound.conf as follows:

server:
  interface: 0.0.0.0
  use-syslog: yes
  username: "unbound"
  directory: "/etc/unbound"
  access-control: 192.168.10.0/24 allow
  do-ip6: no
  do-not-query-localhost: no

stub-zone:
  name: "mkt3.dev"
  stub-addr: 127.0.0.1@53530

forward-zone:
  name: "."
  forward-addr: 8.8.8.8

Starting and Enabling Unbound

#

Start the Unbound service:

sudo systemctl start unbound.service

Enable Unbound at boot:

sudo systemctl enable unbound.service

Verifying Unbound Operation

#

Ensure external and internal domains resolve correctly:

drill @127.0.0.1 -p 53 www.google.co.jp
drill @127.0.0.1 -p 53 ns.mkt3.dev

Configuring iptables

#

To expose the DNS server within the LAN, allow access to port 53:

iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT

For further details, refer to: iptables Configuration.