DNS BIND acl clause

This section describes the use of the acl (Access Control List) clause available in BIND 9.x named.conf. The 'acl' clause allows fine-grained control over what hosts or users may perform what operations on the name server.

acl clause syntax

acl acl-name { 
    address_match_list 
};

acl's define a address_match_list e.g. IP address(es), which are then referenced (used) in a number of statements and the view clause(s). acl's MUST be defined before they are referenced in any other statement or clauses. For this reason they are usually defined first in the named.conf file. 'acl-name' is an arbitrary (but unique) quoted string defining the specific list. The 'acl-name' is the method used to reference the particular list. Any number of acl's may be defined. The following special 'acl-name' values are built into BIND:

  1. "none" - matches no hosts

  2. "any" - matches all hosts

  3. "localhost" - matches all the IP address(es) of the server on which BIND is running e.g. if the server has a single interface with an IP address of 192.168.2.3 then localhost will match 192.168.2.3 and 127.0.0.1 (the loopback address is always present).

  4. "localnets" - matches all the IP address(es) and subnetmasks of the server on which BIND is running i.e. if the server has a single interface with an IP address of 192.168.2.3 and a netmask of 255.255.255.0 (or 192.168.2.2/24) then localnets will match 192.168.2.0 to 192.168.2.255 and 127.0.0.1 (the loopback is assumed to be a single address). Some systems do not provide a way to determine the prefix lengths of local IPv6 addresses. In such a case, localnets only matches the local IPv6 addresses, just like localhost.

acl Examples

The following examples show acls being created and used including the 'special' acl's.

//defining acl's
// simple ip address acl
acl "someips" {
  10.0.0.1; 192.168.23.1; 192.168.23.15;
};
 // ip address acl with '/' format
 acl "moreips" {
  10.0.0.1; 
  192.168.23.128/25; // 128 IPs
};
// nested acl
acl "allips" {
  "someips"; 
  "moreips";
};
// messy acl
acl "complex" {
  "someips"; 
  10.0.15.0/24;
  !10.0.16.1/24; // negated
  {10.0.17.1;10.0.18.2;}; // nested
 };
// using acl's
zone "example.com" {
  type slave;
  file "slave.example.com";
  allow-notify {"complex";}; 
};
zone "example.net" {
  type slave;
  masters {192.168.2.3;192.168.2.4};
  file "slave.example.net;
  allow-transfer {"none";}; // this is a special acl
};