• Intro
• acl-clause-syntax
• acl-examples

DNS BIND acl clause
This section describes the use of the acl (Access Control List) clause available
in BIND 9.x named.conf. The acl clause allows fine-grained control over what 
hosts or users may perform what operations on the name server.



acl clause syntax
acl acl-name 
{ 
    address_match_list 
}; 

acl's define a address_match_list e.g. IP address(es), which can then be 
referenced (used) in a number of statements and the view clause(s). acl's MUST 
be defined before they are referenced in any statement or clause. For this 
reason they are usually defined first in the named.conf file. 'acl-name' is an 
arbitrary (but unique) quoted string defining the specific list. The 'acl-name'
is the method used to subsequently reference the particular list. Any number of
acl's may be defined.

The following special acl-name values are built into BIND:

"none" - matches no hosts
"any" - matches all hosts
"localhost" - matches all the IP address(es) of the server on which BIND is
running e.g. if the server has a single interface with an IP address of 
192.168.2.3 then localhost will match 192.168.2.3 and 127.0.0.1 (the loopback 
address is always present).
"localnets" - matches all the IP address(es) and subnetmasks of the server 
on which BIND is running i.e. if the server has a single interface with an IP 
address of 192.168.2.3 and a netmask of 255.255.255.0 (or 192.168.2.2/24) then 
localnets will match 192.168.2.0 to 192.168.2.255 and 127.0.0.1 (the loopback is
assumed to be a single address). Some systems do not provide a way to determine
the prefix lengths of local IPv6 addresses. In such a case, localnets only 
matches the local IPv6 addresses, just like localhost.


Note:
It is important to remember that only the defined IPs in the address list match
will be used. Sometimes it is easier or quicker to define a negative list of IP
address (all IPs EXCEPT these IP addresses) in this case the special value "any"
must be used as illustrated in the fragments below:

// NEGATIVE ACL - THIS DOES NOT WORK
acl "not-these-ips" 
{
    !192.168.0/24;!10.0/16;
}

// NEGATIVE ACL - THIS DOES WORK
// ALL IPs EXCEPT 192.168.0/24 AND 10.0/16
acl "not-these-ips" 
{
    !192.168.0/24;!10.0/16;any;
}



acl Examples
The following examples show acls being created and used including the 'special'
acl's.

//defining acl's
// SIMPLE IP ADDRESS ACL
acl "someips" 
{
    10.0.0.1; 192.168.23.1; 192.168.23.15;
};
 // IP ADDRESS ACL WITH '/' FORMAT
acl "moreips" 
{
    10.0.0.1; 
    192.168.23.128/25; // 128 IPs
};
// NESTED ACL
acl "allips" 
{
    "someips"; 
    "moreips";
};
// MESSY ACL
acl "complex" 
{
    "someips"; 
    10.0.15.0/24;
    !10.0.16.1/24; // negated
    {10.0.17.1;10.0.18.2;}; // nested
 };
// USING ACL'S
zone "example.com" 
{
    type slave;
    file "slave.example.com";
    allow-notify {"complex";}; 
};
zone "example.net" 
{
    type slave;
    masters {192.168.2.3;192.168.2.4};
    file "slave.example.net;
    allow-transfer {"none";}; // THIS IS A SPECIAL ACL
};