mail us  |  mail this page

contact us
training  | 
tech stuff  | 

DNS BIND acl clause

This section describes the use of the acl (Access Control List) clause available in BIND 9.x named.conf. The acl clause allows fine-grained control over what hosts or users may perform what operations on the name server.

acl clause syntax

acl acl-name { 
    address_match_list 
};

acl's define a address_match_list e.g. IP address(es), which can then be referenced (used) in a number of statements and the view clause(s). acl's MUST be defined before they are referenced in any statement or clause. For this reason they are usually defined first in the named.conf file. 'acl-name' is an arbitrary (but unique) quoted string defining the specific list. The 'acl-name' is the method used to subsequently reference the particular list. Any number of acl's may be defined.

The following special acl-name values are built into BIND:

  1. "none" - matches no hosts

  2. "any" - matches all hosts

  3. "localhost" - matches all the IP address(es) of the server on which BIND is running e.g. if the server has a single interface with an IP address of 192.168.2.3 then localhost will match 192.168.2.3 and 127.0.0.1 (the loopback address is always present).

  4. "localnets" - matches all the IP address(es) and subnetmasks of the server on which BIND is running i.e. if the server has a single interface with an IP address of 192.168.2.3 and a netmask of 255.255.255.0 (or 192.168.2.2/24) then localnets will match 192.168.2.0 to 192.168.2.255 and 127.0.0.1 (the loopback is assumed to be a single address). Some systems do not provide a way to determine the prefix lengths of local IPv6 addresses. In such a case, localnets only matches the local IPv6 addresses, just like localhost.

Note: It is important to remember that only the defined IPs in the address list match will be used. Sometimes it is easier or quicker to define a negative list of IP address (all IPs EXCEPT these IP addresses) in this case the special value "any" must be used as illustrated in the fragments below:

// negative acl - this does NOT work
acl "not-these-ips" {
  !192.168.0/24;!10.0/16;
}

// negative acl - this does work
// all IPs EXCEPT 192.168.0/24 and 10.0/16
acl "not-these-ips" {
  !192.168.0/24;!10.0/16;any;
}

acl Examples

The following examples show acls being created and used including the 'special' acl's.

//defining acl's
// simple ip address acl
acl "someips" {
  10.0.0.1; 192.168.23.1; 192.168.23.15;
};
 // ip address acl with '/' format
 acl "moreips" {
  10.0.0.1; 
  192.168.23.128/25; // 128 IPs
};
// nested acl
acl "allips" {
  "someips"; 
  "moreips";
};
// messy acl
acl "complex" {
  "someips"; 
  10.0.15.0/24;
  !10.0.16.1/24; // negated
  {10.0.17.1;10.0.18.2;}; // nested
 };
// using acl's
zone "example.com" {
  type slave;
  file "slave.example.com";
  allow-notify {"complex";}; 
};
zone "example.net" {
  type slave;
  masters {192.168.2.3;192.168.2.4};
  file "slave.example.net;
  allow-transfer {"none";}; // this is a special acl
};


Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.

Pro DNS and BIND by Ron Aitchison

Contents

tech info
guides home
dns articles
intro
contents
1 objectives
big picture
2 concepts
3 reverse map
4 dns types
quickstart
5 install bind
6 samples
reference
7 named.conf
8 zone records
operations
9 howtos
10 tools
11 trouble
programming
12 bind api's
security
13 dns security
bits & bytes
15 messages
resources
notes & tips
registration FAQ
dns resources
dns rfcs
change log

Creative Commons License
This work is licensed under a Creative Commons License.

If you are happy it's OK - but your browser is giving a less than optimal experience on our site. You could, at no charge, upgrade to a W3C STANDARDS COMPLIANT browser such as Firefox

Search

web zytrax.com

Share

share page via facebook tweet this page

Page

email us Send to a friend feature print this page Decrease font size Increase font size Display full width page

Resources

Systems

FreeBSD
NetBSD
OpenBSD
DragonFlyBSD
Linux.org
Debian Linux

Software

LibreOffice
OpenOffice
Mozilla
GitHub
GNU-Free SW Foundation
get-dns

Organizations

Open Source Initiative
Creative Commons

Misc.

Ibiblio - Library
Open Book Project
Open Directory
Wikipedia

Site

CSS Technology SPF Record Conformant Domain
Copyright © 1994 - 2017 ZyTrax, Inc.
All rights reserved. Legal and Privacy
site by zytrax
Hosted by super.net.sg
web-master at zytrax
Page modified: October 21 2015.