3

我正在尝试在 Raspberry pi 3 上运行 2 个 Docker 容器，一个用于 Unbound，一个用于 Pihole。这个想法是 Pihole 在使用 Unbound 作为其 DNS 服务器之前将首先阻止任何请求。我一直在关注 Pihole 的文档以在此处找到此运行，并且已经启动了两个容器，并且 pihole 正在工作。但是，在运行docker exec pihole dig pi-hole.net @127.0.0.1 -p 5333或-p 5354我得到响应时

; <<>> DiG 9.10.3-P4-Debian <<>> pi-hole.net @127.0.0.1 -p 5354
;; global options: +cmd
;; connection timed out; no servers could be reached

我推测这可能与 pihole 容器无法通过 localhost 与 Unbound 容器通信有关，因此更新了我的 docker-compose 以尝试使用 netowkr 网桥纠正此问题。但是，在那之后，无论我尝试什么端口，我仍然会遇到同样的错误。我是新来的 Docker 和 Unbound，所以这有点深入探讨了！我的 docker-compose.yml 和 unbound.conf 在下面。

码头工人-compose.yml

version: "3.7"

services:
  unbound:
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    container_name: unbound
    image: masnathan/unbound-arm
    ports:
      - 8953:8953/tcp
      - 5354:53/udp
      - 5354:53/tcp
      - 5333:5333/udp
      - 5333:5333/tcp
    volumes:
      - ./config/unbound.conf:/etc/unbound/unbound.conf
      - ./config/root.hints:/var/unbound/etc/root.hints
    restart: always
    networks:
      - unbound-pihole
  pihole:
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - 53:53/udp
      - 53:53/tcp
      - 67:67/udp
      - 80:80
      - 443:443
    volumes:
      - ./config/pihole/:/etc/pihole/
    environment:
      - ServerIP=10.0.0.20
      - TZ=UTC
      - WEBPASSWORD=random
      - DNS1=127.0.0.1#5333
      - DNS2=no
    restart: always 
    networks:
      - unbound-pihole

networks:
  unbound-pihole:
    driver: bridge

未绑定的.conf

server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
verbosity: 0

port: 5333
do-ip4: yes
do-udp: yes
do-tcp: yes

# May be set to yes if you have IPv6 connectivity
do-ip6: no

# Use this only when you downloaded the list of primary root servers!
root-hints: "/var/unbound/etc/root.hints"

# Trust glue only if it is within the servers authority
harden-glue: yes

# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes

# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no

# Reduce EDNS reassembly buffer size.
# Suggested by the unbound man page to reduce fragmentation reassembly problems
edns-buffer-size: 1472

# TTL bounds for cache
cache-min-ttl: 3600
cache-max-ttl: 86400

# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes

# One thread should be sufficient, can be increased on beefy machines
num-threads: 1

# Ensure kernel buffer is large enough to not loose messages in traffic spikes
so-rcvbuf: 1m

# Ensure privacy of local IP ranges
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10

谢谢！

4

1 回答 1

4

从文档https://nlnetlabs.nl/documentation/unbound/unbound.conf/下access-control section：

  By default only localhost is allowed, the rest is refused.   The
  is  refused, because that is protocol-friendly. The DNS
  protocol is not designed to handle dropped packets due  to  pol-
  icy,  and  dropping  may  result in (possibly excessive) retried
  queries.

未绑定服务器，默认情况下localhost仅侦听来自的连接。在这种情况下，可以允许从运行未绑定的 docker 容器内部接受对 DNS 服务器的请求。

因此，要让 docker-compose 中的 unbound 解析 DNS，请将以下内容添加到unbound.conf

server:
   access-control: 0.0.0.0/0 allow
于 2019-08-04T13:25:10.917 回答