Advance preparation

  • Prepare an Azure private DNS and link it to the virtual network (this time it was a zeus.examplezone.)
  • Set up a VM to be a DNS cache server

Introduce unbound

sudo apt update && sudo apt install unbound

It fails to start, Systemd-resolvedbut is because is running. You can ignore it once.

Create unbound settings

The unbound version of libevent was distributed to the Ubuntu 18.04.4 LTS repository, so the setting is for libevent. The memory is assumed to run only unbound on a 512MB environment.

access-control: allow
verbosity: 1
rrset-roundrobin: yes
minimal-responses: yes
cache-max-ttl: 86400

###### Tuning
num-threads: 1
msg-cache-slabs: 2
rrset-cache-slabs: 2
infra-cache-slabs: 2
key-cache-slabs: 2
rrset-cache-size: 100m
msg-cache-size: 50m
so-rcvbuf: 4m
so-sndbuf: 4m
infra-cache-numhosts: 1000

###### use libevent
outgoing-range: 4096
num-queries-per-thread: 4096

###### security consideration
hide-version: yes

domain-insecure: "zeus.example"

# Throw all to Azure internal DNS (
name: "."
forward-addr: ""

Although I put it in the title “Use Azure Private DNS”, if I link Azure Private DNS to the virtual network, Azure internal DNS will do a good job, so I’m just throwing it.

rrset-roundrobinI think it is good to enable it so that it is properly distributed.

access-controlIs localhostexplicitly allowed, as it is only allowed if omitted . You can specify more than one, so write multiple if you span the range. I do not intend to make the security stupid, but because it is controlled by Azure's Network Security Group.

Kernel parameter adjustment

sudo tee /etc/sysctl.conf << EOF 

# Secure 4M receive buffer
net.core.rmem_max = 4194304
# Secure 4M send buffer
net.core.wmem_max = 4194304

# Reload settings
sudo sysctl -p

If you do not adjust it, a log like this will appear.

warning: so-rcvbuf 4194304 was not granted. Got 425984. To fix: start with root permissions(linux) or sysctl bigger net.core.rmem_max(linux) or kern.ipc.maxsockbuf(bsd) values.

Stop existing DNS service and start unbound

# Rewrite /etc/reslov.conf 
sudo sed -i's /127\.0\.0\.53/' /etc/resolv.conf

Disable Systemd-resolved sudo systemctl disable systemd-resolved
sudo systemctl stop systemd-resolved

start unbound sudo systemctl start unbound

Now it becomes a DNS cache server that queries Unbound → Azure internal DNS. Check by doing nslookup locally.



DevOps Consultant. I’m strongly focused on automation, security, and reliability.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store

DevOps Consultant. I’m strongly focused on automation, security, and reliability.