mail us  |  mail this page

contact us
training  | 
tech stuff  | 

BIND 9 Support

BIND Definition of Address List Match

This section defines the term address_match_list used with many named.conf statements. Full list of statements. The full syntax allows many variations:

address_match_list = element ; [ element; ... ]

An address_match_list is comprised of one or more elements each of which has the following syntax:

element = [!] (ip [/prefix] | key key-name | "acl_name" | { address_match_list } )

The elements which make up an address match list can be:

  1. Optional negation ("!") of an element;

  2. An IP address (IPv4 or IPv6);

  3. An IP prefix (using the slash (/) notation), for example, 10.0/16 or 192.168.2/24; (More info on IP Prefix (/) notation.)

  4. A key-name, as it appears in a key clause;

  5. The name of an address_match_list previously defined with an ACL clause;

  6. A nested address match list enclosed in braces;

  7. One of four predefined names described below.

The four predefined address_match_list names are:

  1. "none" - matches no host IP addresses

  2. "any" - matches all host IP addresses

  3. "localhost" - matches all the IP address(es) of the server on which BIND is running but only when accessed from the same host (internal). For example, if the server has a single interface with an IP address of then localhost will match and (the loopback address is always present) when issued from the same host, but if any external request arrives on it will not match.

  4. "localnets" - matches all the IP address(es) and subnetmasks of the server on which BIND is running. For example, if the server has a single interface with an IP address of and a netmask of (or then localnets will match to and (the loopback is always present and has a single address, that is a netmask of Some systems do not provide a way to determine the prefix lengths of local IPv6 addresses. In such a case, localnets only matches the local IP addresses, just like localhost though in this case it will apply to external and internal (same host) requests.

When a given IP address is compared to an address_match_list, the list is traversed in order until an element matches at which point processing stops. The action taken will depend on the context of the statement to which it is being applied as shown in the following example:

options {
    allow-transfer { !;192.168.2/24;};

If the IP address requests a transfer it does not match the first element but matches the second element and the transfer is permitted, if, however, IP requests a transfer it matches the first element which is negated meaning the transfer is denied. Because a match stops processing the match order is significant. If the above were rewritten to reverse the order then would always be permitted to transfer because the first item always matches as shown below:

options {
     // incorrect version - permits
     allow-transfer {; !;};

The general rule may be expressed as "a non-negated match permits the operation and a negated match denies the operation, if there is no match the operation is denied". The following example shows the use of an ACL clause to standardize an address_match_list, by simply changing the contents of the ACL these changes are propagated to all users of the acl clause:

acl "good-guys" {
     !; // denies first 16 IPs
     192.168.2/24;    // allows rest of subnet
     localnets;       // allows our local network
     2001:db8:0:1::/64; // allows this subnet only
options {
      allow-transfer {"good-guys";};

Note: Address_match_lits is order significant. Had the first two elements been inverted the whole of 192.168.2 would have been allowed.

The key-name parameter allows the address_match_list to reference a key clause - the match in this case will occur if the keys match.

Nesting is allowed but is only used with the topology (not currently implemented) and the sortlist statement and the address_match_list behavior is slightly changed. Nesting use is described in the context of the sortlist statement.

Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.

Pro DNS and BIND by Ron Aitchison


tech info
guides home
dns articles
1 objectives
big picture
2 concepts
3 reverse map
4 dns types
5 install bind
6 samples
7 named.conf
8 zone records
9 howtos
10 tools
11 trouble
12 bind api's
13 dns security
bits & bytes
15 messages
notes & tips
registration FAQ
dns resources
dns rfcs
change log

Creative Commons License
This work is licensed under a Creative Commons License.

If you are happy it's OK - but your browser is giving a less than optimal experience on our site. You could, at no charge, upgrade to a W3C STANDARDS COMPLIANT browser such as Firefox




Icons made by Icomoon from is licensed by CC 3.0 BY
share page via facebook tweet this page


email us Send to a friend feature print this page Display full width page Decrease font size Increase font size



Debian Linux


GNU-Free SW Foundation


Open Source Initiative
Creative Commons


Ibiblio - Library
Open Book Project
Open Directory


CSS Technology SPF Record Conformant Domain
Copyright © 1994 - 2024 ZyTrax, Inc.
All rights reserved. Legal and Privacy
site by zytrax
hosted by
web-master at zytrax
Page modified: February 26 2024.