# Unbound configuration file for Debian.
#
# See the unbound.conf(5) man page.
#
# See /usr/share/doc/unbound/examples/unbound.conf for a commented
# reference config file.

server:
    # The following line will configure unbound to perform cryptographic
    # DNSSEC validation using the root trust anchor.
    auto-trust-anchor-file: "/var/lib/unbound/root.key"

    # enable to not answer id.server and hostname.bind queries.
    hide-identity: yes

    # enable to not answer version.server and version.bind queries.
    hide-version: yes

    # Harden against very small EDNS buffer sizes. 
    harden-short-bufsize: yes

    # Harden against unseemly large queries.
    harden-large-queries: yes


    # Enforce privacy of these addresses. Strips them away from answers. 
    # It may cause DNSSEC validation to additionally mark it as bogus. 
    # Protects against 'DNS Rebinding' (uses browser as network proxy). 
    # Only 'private-domain' and 'local-data' names are allowed to have 
    # these private addresses.
    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: fd00::/8
    private-address: fe80::/10



forward-zone:
        name: "nos-oignons.net"
        forward-addr: 91.224.149.171
        forward-addr: 2a01:6600:8081:ab00::1

forward-zone:
        name: "nos-oignons.org"
        forward-addr: 91.224.149.171
        forward-addr: 2a01:6600:8081:ab00::1

forward-zone:
        name: "nos-oignons.fr"
        forward-addr: 91.224.149.171
        forward-addr: 2a01:6600:8081:ab00::1
