I am trying to implement this using Unbound and Nsd: https://support.google.com/websearch/answer/186669?hl=en
To force SafeSearch for your network, you’ll need to update your DNS. configuration. Set the DNS entry for www.google.com (and any other Google ccTLD country subdomains your users may use) to be a CNAME for forcesafesearch.google.com.
We will serve SafeSearch Search and Image Search results for requests that we receive on this VIP
I currently have Unbound in pfsense 2.3 set as a recursive DNS resolver. Requests for Google are forwarded to BIND which is listening on localhost. BIND is using an RPZ (Response Policy Zone) and forwards it to google DNS server 18.104.22.168 . A similar approach is found in HK1's answer:
All posts on internet use host override except the above example. If the IP address changes, then conf files will need to be changed manually which isn't most reliable option. For performance, footprint ( old hardware ) and possible security enhancements, I would like to switch Bind with Nsd. I would like Unbound to do all resolving. Looking in documentation and forums hasn't led to any fruitful results. With limited testing I always get SERVFAIL when running dig.
I have tried this:
... do-not-query-localhost: no ... stub-zone: name: "google.com." stub-addr: 127.0.0.1@5353 stub-zone: name: "www.google.com." stub-addr: 127.0.0.1@5353 stub-zone: name: "google.com.au." stub-addr: 127.0.0.1@5353 stub-zone: name: "www.google.com.au." stub-addr: 127.0.0.1@5353 ...
... server: ip-address: 127.0.0.1 port: 5353 ... zone: name: "google.com" zonefile: "google.com.zone" zone: name: "google.com.au" zonefile: "google.com.au.zone" zone: name: "www.google.com" zonefile: "www.google.com.zone" zone: name: "www.google.com.au" zonefile: "www.google.com.au.zone" ...
$TTL 60 @ IN SOA localhost. root.localhost. ( 2017050500; 10800; 3600; 604800; 10800 ) IN NS localhost. ; ; Google forced Safe Search zone and data google.com CNAME forcesafesearch.google.com. www.google.com CNAME forcesafesearch.google.com. google.com.au CNAME forcesafesearch.google.com. www.google.com.au CNAME forcesafesearch.google.com. ...
Is it possible to use Nsd for Google's safesearch and if so how? ( If a newer version is required, switching to ubuntu server is possible)
Any help would be appreciated.