Tproxy Router Mode
With Local Dns (Unblock Situs Terlarang)

IP Gateway                                  : 192.168.10.50        
Eth0 (  terhunung ke Gateway )  : 192.168.10.200
Eth1 (  terhunung ke LAN )        : 192.168.1.50  (Dijadikan Gateway Di Warnet)

Sript Iptabless  ( Copas Diatas exit 0 /etc/rc.local )

iptables -t nat -A PREROUTING -s 192.168.10.200 -p tcp --dport 443 -j ACCEPT iptables -t nat -A PREROUTING -s 192.168.10.200 -p tcp --dport 80 -j ACCEPT iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 80 -j DNAT --to-destination 192.168.10.200:3129 iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 443 -j DNAT --to-destination 192.168.10.200:3127 iptables -t nat -A PREROUTING -i eth1 -p udp --dport 53 -j DNAT --to 192.168.1.200:53 iptables -t mangle -A PREROUTING -p tcp --dport 3129 -j DROP iptables -t mangle -A PREROUTING -p tcp --dport 3127 -j DROP iptables -t nat -A POSTROUTING -j MASQUERADE

/etc/network/interfaces

# This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). source /etc/network/interfaces.d/* # The loopback network interface auto lo iface lo inet loopback auto eth0 iface eth0 inet static address 192.168.10.200 netmask 255.255.255.0 network 192.168.10.0 broadcast 192.168.20.255 dns-nameserver 127.0.0.1 gateway 192.168.10.50 dns-nameserver 8.8.8.8 auto eth1 iface eth1 inet static address 192.168.1.200 netmask 255.255.255.0 network 192.168.1.0 broadcast 192.168.1.255 auto eth1 iface eth1 inet static address 192.168.1.50 netmask 255.255.255.0 network 192.168.1.0 broadcast 192.168.1.255

/etc/unbound/unbound.conf 

server: verbosity: 1 statistics-interval: 120 num-threads: 1 interface: 0.0.0.0 outgoing-range: 512 num-queries-per-thread: 1024 msg-cache-size: 16m rrset-cache-size: 32m msg-cache-slabs: 4 rrset-cache-slabs: 4 cache-max-ttl: 86400 infra-host-ttl: 60 infra-lame-ttl: 120 infra-cache-numhosts: 10000 infra-cache-lame-size: 10k do-ip4: yes do-ip6: no do-udp: yes do-tcp: yes do-daemonize: yes # ip-transparent: yes interface-automatic: yes #access-control: 0.0.0.0/0 allow access-control: 192.168.0.0/16 allow access-control: 172.16.0.0/12 allow access-control: 10.0.0.0/8 allow access-control: 127.0.0.0/8 allow access-control: 0.0.0.0/0 refuse chroot: "/etc/unbound" username: "unbound" directory: "/etc/unbound" #logfile: "/etc/unbound/unbound.log" #use-syslog: yes logfile: "" use-syslog: no pidfile: "/etc/unbound/unbound.pid" root-hints: "/etc/unbound/named.cache" identity: "DNS" version: "1.4" hide-identity: yes hide-version: yes harden-glue: yes do-not-query-address: 127.0.0.1/8 do-not-query-localhost: yes module-config: "iterator" local-zone: "local.lan" transparent #zone localhost local-zone: "localhost." static local-data: "localhost. 10800 IN NS localhost." local-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local-data: "localhost. 10800 IN A 127.0.0.1" local-zone: "127.in-addr.arpa." static local-data: "127.in-addr.arpa. 10800 IN NS localhost." local-data: "127.in-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 2 3600 1200 604800 10800" local-data: "1.0.0.127.in-addr.arpa. 10800 IN PTR localhost." #zone mulya.net local-zone: "mulya.net." static local-data: "mulya.net. 86400 IN NS ns1.mulya.net." local-data: "mulya.net. 86400 IN SOA mulya.net. hostmaster.mulya.net. 3 3600 1200 604800 86400" local-data: "mulya.net. 86400 IN A 192.168.1.200" local-data: "www.mulya.net. 86400 IN A 192.168.1.200" local-data: "ns1.mulya.net. 86400 IN A 192.168.1.200" local-data: "mail.mulya.net. 86400 IN A 192.168.1.200" local-data: "mulya.net. 86400 IN MX 10 mail.mulya.net." local-data: "mulya.net. 86400 IN TXT v=spf1 a mx ~all" local-zone: "1.168.192.in-addr.arpa." static local-data: "1.168.192.in-addr.arpa. 10800 IN NS mulya.net." local-data: "1.168.192.in-addr.arpa. 10800 IN SOA mulya.net. hostmaster.mulya.net. 4 3600 1200 604800 864000" local-data: "200.1.168.192.in-addr.arpa. 10800 IN PTR mulya.net." forward-zone: name: "." forward-addr: 208.67.222.222@443 remote-control: control-enable: yes control-interface: 127.0.0.1 control-port: 953 server-key-file: "/etc/unbound/unbound_server.key" server-cert-file: "/etc/unbound/unbound_server.pem" control-key-file: "/etc/unbound/unbound_control.key" control-cert-file: "/etc/unbound/unbound_control.pem"

NB : Untuk IP Di Sesuaikan Sendiri yah....   Termasuk Di Localzone Unbound