Write BIND access control lists

Controlling access to certain features of BIND can prevent unauthorized access and attacks, such as denial of service (DoS). BIND access control list (ACL) statements are lists of IP addresses and ranges.

Before you begin

  • You have configured BIND as a caching name server.
  • The named or named-chroot service is running.

About this task

Each ACL has a nickname that you can use in several statements, such as allow-query that refer to the specified IP addresses and ranges.

Warning

BIND uses only the first matching entry in an ACL. For example, if you define an ACL { 192.0.2/24; !192.0.2.1; } and the host with IP address 192.0.2.1 connects, BIND grants access even if the second entry excludes this address.

BIND has the following built-in ACLs:

  • none: Matches no hosts.
  • any: Matches all hosts.
  • localhost: Matches the loopback addresses 127.0.0.1 and ::1, and the IP addresses of all interfaces on the server that runs BIND.
  • localnets: Matches the loopback addresses 127.0.0.1 and ::1, and all subnets the server that runs BIND is directly connected to.

Procedure

  1. Edit the /etc/named.conf file and make the following changes:
    1. Add acl statements to the file. For example, to create an ACL named internal-networks for 127.0.0.1, 192.0.2.0/24, and 2001:db8:1::/64, enter: 
      acl internal-networks { 127.0.0.1; 192.0.2.0/24; 2001:db8:1::/64; };
acl dmz-networks { 198.51.100.0/24; 2001:db8:2::/64; };
    2. Use the ACL’s nickname in statements that support them, for example: 
      allow-query     { internal-networks; dmz-networks; };
allow-recursion { internal-networks; };
  2. Verify the syntax of the /etc/named.conf file: 
    # named-checkconf

    No output indicates that the syntax is correct.

  3. Reload BIND: 
    # systemctl reload named

    If you run BIND in a change-root environment, use the systemctl reload named-chroot command to reload the service.

Results

  • Execute an action that triggers a feature, which uses the configured ACL. For example, the ACL allows only recursive queries from the defined IP addresses. In this case, enter the following command on a host that is not within the ACL’s definition to try to resolve an external domain: 
    # dig +short @192.0.2.1www.example.com

    If the command returns no output, BIND is denied access, and the ACL works. For a verbose output on the client, use the command without +short option:

    # dig @192.0.2.1www.example.com
     
    ...
;; WARNING: recursion requested but not available
...