diff --git a/Dockerfile b/Dockerfile
index 3b5ae8e4..7f27e3d1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,14 @@ LABEL maintainer="quentin.mcgaw@gmail.com" \
       ram="11MB" \
       cpu_usage="Low" \
       github="https://github.com/qdm12/private-internet-access-docker"
-RUN apk add -q --progress --no-cache --update openvpn ca-certificates iptables ip6tables && \
+HEALTHCHECK --interval=1m --timeout=10s --start-period=10s --retries=1 \
+            CMD export OLD_VPN_IP="$NEW_VPN_IP" && \
+                export NEW_VPN_IP=$(wget -qqO- 'https://duckduckgo.com/?q=what+is+my+ip' | grep -ow 'Your IP address is [0-9.]*[0-9]' | grep -ow '[0-9][0-9.]*') && \
+                [ "$NEW_VPN_IP" != "$INITIAL_IP" ] && [ "$NEW_VPN_IP" != "$OLD_VPN_IP" ] || exit 1
+ENV ENCRYPTION=strong \
+    PROTOCOL=tcp \
+    REGION=Germany
+RUN apk add -q --progress --no-cache --update openvpn ca-certificates iptables ip6tables unbound && \
     apk add -q --progress --no-cache --update --virtual=build-dependencies unzip && \
     mkdir /openvpn-udp-normal /openvpn-udp-strong /openvpn-tcp-normal /openvpn-tcp-strong && \
     wget -q https://www.privateinternetaccess.com/openvpn/openvpn.zip \
@@ -18,14 +25,7 @@ RUN apk add -q --progress --no-cache --update openvpn ca-certificates iptables i
     unzip -q openvpn-tcp.zip -d /openvpn-tcp-normal && \
     unzip -q openvpn-strong-tcp.zip -d /openvpn-tcp-strong && \
     apk del -q --progress --purge build-dependencies && \
-    rm -rf /*.zip /var/cache/apk/*
-HEALTHCHECK --interval=10m --timeout=10s --start-period=10s --retries=1 \
-            CMD export OLD_VPN_IP="$NEW_VPN_IP" && \
-                export NEW_VPN_IP=$(wget -qqO- 'https://duckduckgo.com/?q=what+is+my+ip' | grep -ow 'Your IP address is [0-9.]*[0-9]' | grep -ow '[0-9][0-9.]*') && \
-                [ "$NEW_VPN_IP" != "$INITIAL_IP" ] && [ "$NEW_VPN_IP" != "$OLD_VPN_IP" ] || exit 1
-ENV ENCRYPTION=strong \
-    PROTOCOL=tcp \
-    REGION=Germany
+    rm -rf /*.zip /var/cache/apk/* /etc/unbound/unbound.conf
+COPY unbound.conf /etc/unbound/unbound.conf
 COPY entrypoint.sh /
-RUN chmod +x /entrypoint.sh
 ENTRYPOINT /entrypoint.sh
\ No newline at end of file
diff --git a/README.md b/README.md
index baeeafea..56da2430 100644
--- a/README.md
+++ b/README.md
@@ -221,3 +221,9 @@ For more containers, add more `--link pia:xxx` and modify *nginx.conf* according
 - The download and unziping is done at build for the ones not able to download the zip files with their ISPs.
 - Checksums for PIA openvpn zip files are not used as these files change often
 - You should use strong encryption for the environment variable `ENCRYPTION`
+
+### TODOs
+
+- More iptables restrictions
+- Rework readme with unbound required for VPN
+- Block malicious websites with Unbound
\ No newline at end of file
diff --git a/entrypoint.sh b/entrypoint.sh
index a5b6537b..3388c12d 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -2,16 +2,32 @@
 
 printf "=== PIA CONTAINER ==="
 
-# Obtaining your original IP address to use for the healthcheck
+############################################
+# SETTING DNS OVER TLS TO 1.1.1.1 / 1.0.0.1
+############################################
+printf "\nChanging DNS to localhost..."
+echo "nameserver 127.0.0.1" > /etc/resolv.conf
+echo "options ndots:0" >> /etc/resolv.conf
+printf "DONE"
+printf "\nLaunching Unbound daemon to connect to Cloudflare DNS 1.1.1.1 at its TLS endpoint..."
+unbound
+printf "DONE"
+
+############################################
+# ORIGINAL IP FOR HEALTHCHECK
+############################################
 printf "\nGetting non VPN public IP address..."
 export INITIAL_IP=$(wget -qqO- 'https://duckduckgo.com/?q=what+is+my+ip' | grep -ow 'Your IP address is [0-9.]*[0-9]' | grep -ow '[0-9][0-9.]*')
 printf "$INITIAL_IP"
 
+############################################
+# FIREWALL
+############################################
 printf "\nSetting firewall for killswitch purposes..."
 printf "\n * Detecting local subnet..."
 SUBNET=$(ip route show default | tail -n 1 | awk '// {print $1}')
 printf "$SUBNET"
-printf "\n * Detecting parameters to be used for region $REGION, protocol $PROTOCOL and encryption $ENCRYPTION..."
+printf "\n * Reading parameters to be used for region $REGION, protocol $PROTOCOL and encryption $ENCRYPTION..."
 CONNECTIONSTRING=$(grep -i "/openvpn-$PROTOCOL-$ENCRYPTION/$REGION.ovpn" -e 'privateinternetaccess.com')
 PORT=$(echo $CONNECTIONSTRING | cut -d' ' -f3)
 PIADOMAIN=$(echo $CONNECTIONSTRING | cut -d' ' -f2)
@@ -36,8 +52,10 @@ ip6tables -P OUTPUT DROP 2>/dev/null
 printf "\n * Adding rules to accept local loopback traffic..."
 iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 iptables -A OUTPUT -o lo -j ACCEPT
+iptables -A INPUT -i lo -j ACCEPT
 ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null
 ip6tables -A OUTPUT -o lo -j ACCEPT 2>/dev/null
+ip6tables -A INPUT -i lo -j ACCEPT 2>/dev/null
 printf "DONE"
 printf "\n * Adding rules to accept traffic of subnet $SUBNET..."
 iptables -A OUTPUT -d $SUBNET -j ACCEPT
@@ -47,24 +65,39 @@ for ip in $VPNIPS
 do
     printf "\n * Adding rules to accept traffic with $ip on port $PROTOCOL $PORT..."
     iptables -A OUTPUT -j ACCEPT -d $ip -o eth0 -p $PROTOCOL -m $PROTOCOL --dport $PORT
+    iptables -A INPUT -j ACCEPT -s $ip -i eth0 -p $PROTOCOL -m $PROTOCOL --sport $PORT
     ip6tables -A OUTPUT -j ACCEPT -d $ip -o eth0 -p $PROTOCOL -m $PROTOCOL --dport $PORT 2>/dev/null
+    ip6tables -A INPUT -j ACCEPT -s $ip -i eth0 -p $PROTOCOL -m $PROTOCOL --sport $PORT 2>/dev/null
     printf "DONE"
 done
 printf "\n * Adding rules to accept traffic going through the tun device..."
 iptables -A OUTPUT -o tun0 -j ACCEPT
-iptables -A OUTPUT -o tap0 -j ACCEPT
-ip6tables -A OUTPUT -o tap0 -j ACCEPT 2>/dev/null
+iptables -A INPUT -i tun0 -j ACCEPT
 ip6tables -A OUTPUT -o tun0 -j ACCEPT 2>/dev/null
+ip6tables -A INPUT -i tun0 -j ACCEPT 2>/dev/null
 printf "DONE"
 printf "\n * Allowing outgoing DNS queries on port 53 UDP..."
 iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
 ip6tables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT 2>/dev/null
 printf "DONE"
+
+############################################
+# SUMMARY
+############################################
 printf "\n * Starting OpenVPN using the following parameters:"
 printf "\n   * Domain: $PIADOMAIN"
 printf "\n   * Port: $PORT"
 printf "\n   * Protocol: $PROTOCOL"
 printf "\n   * Encryption: $ENCRYPTION\n"
+
+############################################
+# OPENVPN LAUNCH
+############################################
+# RUN AS OTHER USER TODO
 cd /openvpn-$PROTOCOL-$ENCRYPTION
 openvpn --config "$REGION.ovpn" --auth-user-pass /auth.conf
+
+############################################
+# CLEANUP
+############################################
 printf "\nExiting...\n\n"
\ No newline at end of file
diff --git a/unbound.conf b/unbound.conf
new file mode 100644
index 00000000..8be3479f
--- /dev/null
+++ b/unbound.conf
@@ -0,0 +1,18 @@
+server:
+  verbosity: 0
+  use-syslog: yes
+  qname-minimisation: yes
+  do-tcp: yes
+  prefetch: yes
+  rrset-roundrobin: yes
+  use-caps-for-id: yes
+  do-ip4: yes
+  do-ip6: no
+  interface: 127.0.0.1
+  hide-identity: yes
+  hide-version: yes
+forward-zone:
+  name: "."
+  forward-addr: 1.1.1.1@853#cloudflare-dns.com
+  forward-addr: 1.0.0.1@853#cloudflare-dns.com
+  forward-ssl-upstream: yes