1.4. Writing BIND ACLs

• none: Matches no hosts.
• any: Matches all hosts.
• localhost: Matches the loopback addresses 127.0.0.1 and ::1, as well as the IP addresses of all interfaces on the server that runs BIND.
• localnets: Matches the loopback addresses 127.0.0.1 and ::1, as well as all subnets the server that runs BIND is directly connected to.

Prerequisites

• BIND is already configured, for example, as a caching name server.
• The named or named-chroot service is running.

Verification

• Execute an action that triggers a feature which uses the configured ACL. For example, the ACL in this procedure allows only recursive queries from the defined IP addresses. In this case, enter the following command on a host that is not within the ACL’s definition to attempt resolving an external domain:

  # dig +short @192.0.2.1 www.example.com

  If the command returns no output, BIND denied access, and the ACL works. For a verbose output on the client, use the command without +short option:

  # dig @192.0.2.1 www.example.com
  ...
  ;; WARNING: recursion requested but not available
  ...