<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">The original problem was that BIND 9.16 now requires use of CIDR blocks rather than using IP addresses in CIDR notation. Using arbitrary IP address to specify CIDR block doesn’t make much sense and is prone to errors - when you see 10.10.1.0/23 it’s quite hard to tell what was the original intention and whether it’s a typo in the network or in the bits - did the origin author meant 10.10.0.0-10.10.1.255 or 10.20.1.0-10.10.1.255 or something completely else (like 10.10.1.0-10.10.2.255 based on wrong assumption?)<br><br><div dir="ltr"><div>--</div>Ondřej Surý — ISC (He/Him)<div><br></div><div>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div></div><div dir="ltr"><br><blockquote type="cite">On 24. 8. 2022, at 17:34, Sten Carlsen <stenc@s-carlsen.dk> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><br class="">
<div><br class=""><blockquote type="cite" class=""><div class="">On 24 Aug 2022, at 16.52, Greg Choules <<a href="mailto:gregchoules+bindusers@googlemail.com" class="">gregchoules+bindusers@googlemail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Hi Sten.<div class="">That is absolutely what you do *not* want to do.</div><div class=""><br class=""></div><div class="">Writing it out in binary might help. /23 means the following:</div><div class="">11111111 11111111 11111110 00000000</div><div class=""><br class=""></div><div class="">'1' bits mean, test an incoming address against the corresponding bit from the address in the mask.</div><div class="">'0' bits mean, don't test an incoming address against the corresponding bit from the address in the mask.</div><div class=""><br class=""></div><div class="">The ACL <a href="http://10.60.0.0/23" class="">10.60.0.0/23</a> will match *any* address from 10.60.0.0 to 10.60.1.255 *inclusive*.</div><div class=""><br class=""></div><div class="">There is no concept of network address and broadcast address here. It is just pattern matching.</div></div></div></blockquote><div><br class=""></div>Yes, I was (incorrectly) thinking in terms of a /24 network and assumed that removing the ..0 and ..255 addresses was the issue. The proposal would do that by first rejecting (! - means reject) the offending addresses (all have to be listed separately) before doing the above pattern matching.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""><br class=""></div><div class="">Cheers, Greg</div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 24 Aug 2022 at 15:40, Sten Carlsen <<a href="mailto:stenc@s-carlsen.dk" class="">stenc@s-carlsen.dk</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="overflow-wrap: break-word;" class="">I think you want something like this:<div class=""><br class=""></div><div class="">(!10.60.0.0; !10.60.0.255; <a href="http://10.60.0.0/24" target="_blank" class="">10.60.0.0/24</a>)</div><div class=""><br class=""></div><div class="">First deny the two addresses you want not to be part of the <b class="">ACL</b> and then accept the whole network.</div><div class=""><br class=""></div><div class="">First match is used, so 10.60.0.0 would match !10.60.0.0 and be rejected before the next <address_match_element> are tested.</div><div class=""><br class=""></div><div class=""><div class="">
<div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none;" class="">Thanks</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none;" class="">Sten</div>
</div>
<div class=""><br class=""><blockquote type="cite" class=""><div class="">On 24 Aug 2022, at 16.05, Ondřej Surý <<a href="mailto:ondrej@isc.org" target="_blank" class="">ondrej@isc.org</a>> wrote:</div><br class=""><div class=""><div style="overflow-wrap: break-word;" class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 24. 8. 2022, at 15:58, Elias Pereira <<a href="mailto:empbilly@gmail.com" target="_blank" class="">empbilly@gmail.com</a>> wrote:</div><br class=""><div class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:tahoma,sans-serif">hello Ondrej,</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br class=""></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Not completely wrong, because 255 is the broadcast.<br class=""></div></div></div></blockquote><div class=""><br class=""></div><div class="">No, it's not. This is ACL specification, not a interface/network configuration.</div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:tahoma,sans-serif">For a better understanding, then it would be Available range 10.60.0.1 to 10.60.1.254.</div></div></div></blockquote><div class=""><br class=""></div><div class="">No, I've already provided you with a correct answer what <a href="http://10.60.0.0/23" target="_blank" class="">10.60.0.0/23</a> means in terms of range, why do you insist on this?</div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><span class="gmail_default" style="font-family:tahoma,sans-serif"></span>Correctly specified range (without address/host bits) does takes the whole range.<span style="font-family:tahoma,sans-serif" class=""></span></blockquote><div class="gmail_default" style="font-family:tahoma,sans-serif"><br class=""></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Like this 10.60/23; ?</div></div></div></blockquote><div class=""><br class=""></div><div class="">I think others have already answered that, I would be just repeating their answers.</div><div class=""><br class=""></div><div class="">Ondrej</div><div class=""><div class=""><div dir="auto" style="overflow-wrap: break-word;" class=""><div style="overflow-wrap: break-word;" class=""><div style="overflow-wrap: break-word;" class=""><div class="">--</div><div class="">Ondřej Surý (He/Him)</div><div class=""><a href="mailto:ondrej@isc.org" target="_blank" class="">ondrej@isc.org</a></div><div class=""><br class=""></div><div class="">My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div><div class=""><br class=""></div></div></div></div></div></div><br class=""><blockquote type="cite" class=""><div class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 24, 2022 at 10:33 AM Ondřej Surý <<a href="mailto:ondrej@isc.org" target="_blank" class="">ondrej@isc.org</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto" class=""><div dir="ltr" class=""><br class=""></div><div dir="ltr" class=""><br class=""><blockquote type="cite" class="">On 24. 8. 2022, at 15:26, Elias Pereira <<a href="mailto:empbilly@gmail.com" target="_blank" class="">empbilly@gmail.com</a>> wrote:<br class=""><br class=""></blockquote></div><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:tahoma,sans-serif">Hello Greg,</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br class=""></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Why doesn't bind work with networks/subnets in the conventional way?<br class=""></div></div></div></blockquote><div class=""><br class=""></div><div class="">It does.</div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:tahoma,sans-serif">If the private subnet is <a href="http://10.60.0.0/23" target="_blank" class="">10.60.0.0/23</a>, then it means that the address range is 10.60.0.1 to 10.60.1.254.<br class=""></div></div></div></blockquote><div class=""><br class=""></div><div class="">That’s wrong. <a href="http://10.60.0.0/23" target="_blank" class="">10.60.0.0/23</a> means 10.60.0.0 to 10.60.1.255 range.</div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:tahoma,sans-serif">How do I configure this ACL in named.conf.local so that it takes the whole range?</div></div></div></blockquote><div class=""><br class=""></div><div class="">Correctly specified range (without address/host bits) does takes the whole range.</div><div class=""><br class="">Ondrej <br class=""><div dir="ltr" class=""><div class="">--</div>Ondřej Surý — ISC (He/Him)<div class=""><br class=""></div><div class="">My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div><div class=""><br class=""></div></div></div><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 24, 2022 at 9:31 AM Anand Buddhdev <<a href="mailto:anandb@ripe.net" target="_blank" class="">anandb@ripe.net</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 24/08/2022 14:16, Elias Pereira wrote:<br class="">
<br class="">
Hi Elias,<br class="">
<br class="">
> Oh, sorry... :D<br class="">
> <br class="">
> here it is<br class="">
> <br class="">
> # cat named.conf.local<br class="">
> # ACL das redes internas<br class="">
> # Ultima modificação: 24/08/2022<br class="">
> <br class="">
> acl "internal" {<br class="">
> <a href="http://10.60.0.1/23" rel="noreferrer" target="_blank" class="">10.60.0.1/23</a>;<br class="">
<br class="">
This is the issue. The address part of the prefix should be the lowest <br class="">
address in that prefix. If you change this to <a href="http://10.60.0.0/23" rel="noreferrer" target="_blank" class="">10.60.0.0/23</a>, it will be <br class="">
fine. The same goes for all the other prefixes in your list. Change the <br class="">
1's to 0's.<br class="">
<br class="">
> <a href="http://10.10.1.1/24" rel="noreferrer" target="_blank" class="">10.10.1.1/24</a>;<br class="">
> <a href="http://10.10.2.1/25" rel="noreferrer" target="_blank" class="">10.10.2.1/25</a>;<br class="">
> <a href="http://10.10.3.1/25" rel="noreferrer" target="_blank" class="">10.10.3.1/25</a>;<br class="">
> <a href="http://10.10.4.1/25" rel="noreferrer" target="_blank" class="">10.10.4.1/25</a>;<br class="">
> <a href="http://10.10.5.1/25" rel="noreferrer" target="_blank" class="">10.10.5.1/25</a>;<br class="">
> <a href="http://10.51.0.1/23" rel="noreferrer" target="_blank" class="">10.51.0.1/23</a>;<br class="">
> <a href="http://10.10.6.1/25" rel="noreferrer" target="_blank" class="">10.10.6.1/25</a>;<br class="">
> <a href="http://10.10.7.1/26" rel="noreferrer" target="_blank" class="">10.10.7.1/26</a>;<br class="">
> <a href="http://172.20.0.1/26" rel="noreferrer" target="_blank" class="">172.20.0.1/26</a>;<br class="">
> <a href="http://10.50.0.1/23" rel="noreferrer" target="_blank" class="">10.50.0.1/23</a>;<br class="">
> <a href="http://10.40.0.1/22" rel="noreferrer" target="_blank" class="">10.40.0.1/22</a>;<br class="">
> <a href="http://10.56.0.1/22" rel="noreferrer" target="_blank" class="">10.56.0.1/22</a>;<br class="">
> };<br class="">
</blockquote></div><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div dir="ltr" class="">Elias Pereira</div>
<span class="">-- </span><br class=""><span class="">Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank" class="">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list</span><br class=""><span class=""></span><br class=""><span class="">ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" target="_blank" class="">https://www.isc.org/contact/</a> for more information.</span><br class=""><span class=""></span><br class=""><span class=""></span><br class=""><span class="">bind-users mailing list</span><br class=""><span class=""><a href="mailto:bind-users@lists.isc.org" target="_blank" class="">bind-users@lists.isc.org</a></span><br class=""><span class=""><a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank" class="">https://lists.isc.org/mailman/listinfo/bind-users</a></span><br class=""></div></blockquote></div></blockquote></div><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div dir="ltr" class="">Elias Pereira</div>
</div></blockquote></div><br class=""></div>-- <br class="">Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank" class="">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br class=""><br class="">ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" target="_blank" class="">https://www.isc.org/contact/</a> for more information.<br class=""><br class=""><br class="">bind-users mailing list<br class=""><a href="mailto:bind-users@lists.isc.org" target="_blank" class="">bind-users@lists.isc.org</a><br class=""><a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank" class="">https://lists.isc.org/mailman/listinfo/bind-users</a><br class=""></div></blockquote></div><br class=""></div></div>-- <br class="">
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank" class="">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br class="">
<br class="">
ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank" class="">https://www.isc.org/contact/</a> for more information.<br class="">
<br class="">
<br class="">
bind-users mailing list<br class="">
<a href="mailto:bind-users@lists.isc.org" target="_blank" class="">bind-users@lists.isc.org</a><br class="">
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank" class="">https://lists.isc.org/mailman/listinfo/bind-users</a><br class="">
</blockquote></div>
</div></blockquote></div><br class=""></div></blockquote></body></html>