<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">As I initially thought that bind worked with the normal notation of a subnet, I did the configuration as I initially posted.<br><br>Now with your explanations I see that it is as Greg commented. This is just pattern matching.<br><br>Thank you all!!!<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 24, 2022 at 1:23 PM Ondřej Surý <<a href="mailto:ondrej@isc.org">ondrej@isc.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">The original problem was that BIND 9.16 now requires use of CIDR blocks rather than using IP addresses in CIDR notation. Using arbitrary IP address to specify CIDR block doesn’t make much sense and is prone to errors - when you see <a href="http://10.10.1.0/23" target="_blank">10.10.1.0/23</a> it’s quite hard to tell what was the original intention and whether it’s a typo in the network or in the bits - did the origin author meant 10.10.0.0-10.10.1.255 or 10.20.1.0-10.10.1.255 or something completely else (like 10.10.1.0-10.10.2.255 based on wrong assumption?)<br><br><div dir="ltr"><div>--</div>Ondřej Surý — ISC (He/Him)<div><br></div><div>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div></div><div dir="ltr"><br><blockquote type="cite">On 24. 8. 2022, at 17:34, Sten Carlsen <<a href="mailto:stenc@s-carlsen.dk" target="_blank">stenc@s-carlsen.dk</a>> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><br>
<div><br><blockquote type="cite"><div>On 24 Aug 2022, at 16.52, Greg Choules <<a href="mailto:gregchoules+bindusers@googlemail.com" target="_blank">gregchoules+bindusers@googlemail.com</a>> wrote:</div><br><div><div dir="ltr">Hi Sten.<div>That is absolutely what you do *not* want to do.</div><div><br></div><div>Writing it out in binary might help. /23 means the following:</div><div>11111111 11111111 11111110 00000000</div><div><br></div><div>'1' bits mean, test an incoming address against the corresponding bit from the address in the mask.</div><div>'0' bits mean, don't test an incoming address against the corresponding bit from the address in the mask.</div><div><br></div><div>The ACL <a href="http://10.60.0.0/23" target="_blank">10.60.0.0/23</a> will match *any* address from 10.60.0.0 to 10.60.1.255 *inclusive*.</div><div><br></div><div>There is no concept of network address and broadcast address here. It is just pattern matching.</div></div></div></blockquote><div><br></div>Yes, I was (incorrectly) thinking in terms of a /24 network and assumed that removing the ..0 and ..255 addresses was the issue. The proposal would do that by first rejecting (! - means reject) the offending addresses (all have to be listed separately) before doing the above pattern matching.</div><div><br><blockquote type="cite"><div><div dir="ltr"><div><br></div><div>Cheers, Greg</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 24 Aug 2022 at 15:40, Sten Carlsen <<a href="mailto:stenc@s-carlsen.dk" target="_blank">stenc@s-carlsen.dk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>I think you want something like this:<div><br></div><div>(!10.60.0.0; !10.60.0.255; <a href="http://10.60.0.0/24" target="_blank">10.60.0.0/24</a>)</div><div><br></div><div>First deny the two addresses you want not to be part of the <b>ACL</b> and then accept the whole network.</div><div><br></div><div>First match is used, so 10.60.0.0 would match !10.60.0.0 and be rejected before the next <address_match_element> are tested.</div><div><br></div><div><div>
<div style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">Thanks</div><div style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">Sten</div>
</div>
<div><br><blockquote type="cite"><div>On 24 Aug 2022, at 16.05, Ondřej Surý <<a href="mailto:ondrej@isc.org" target="_blank">ondrej@isc.org</a>> wrote:</div><br><div><div><br><div><blockquote type="cite"><div>On 24. 8. 2022, at 15:58, Elias Pereira <<a href="mailto:empbilly@gmail.com" target="_blank">empbilly@gmail.com</a>> wrote:</div><br><div><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">hello Ondrej,</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Not completely wrong, because 255 is the broadcast.<br></div></div></div></blockquote><div><br></div><div>No, it's not. This is ACL specification, not a interface/network configuration.</div><br><blockquote type="cite"><div><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">For a better understanding, then it would be Available range 10.60.0.1 to 10.60.1.254.</div></div></div></blockquote><div><br></div><div>No, I've already provided you with a correct answer what <a href="http://10.60.0.0/23" target="_blank">10.60.0.0/23</a> means in terms of range, why do you insist on this?</div><br><blockquote type="cite"><div><div dir="ltr"><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><span class="gmail_default" style="font-family:tahoma,sans-serif"></span>Correctly specified range (without address/host bits) does takes the whole range.<span style="font-family:tahoma,sans-serif"></span></blockquote><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Like this 10.60/23; ?</div></div></div></blockquote><div><br></div><div>I think others have already answered that, I would be just repeating their answers.</div><div><br></div><div>Ondrej</div><div><div><div dir="auto"><div><div><div>--</div><div>Ondřej Surý (He/Him)</div><div><a href="mailto:ondrej@isc.org" target="_blank">ondrej@isc.org</a></div><div><br></div><div>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div><div><br></div></div></div></div></div></div><br><blockquote type="cite"><div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 24, 2022 at 10:33 AM Ondřej Surý <<a href="mailto:ondrej@isc.org" target="_blank">ondrej@isc.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="ltr"><br></div><div dir="ltr"><br><blockquote type="cite">On 24. 8. 2022, at 15:26, Elias Pereira <<a href="mailto:empbilly@gmail.com" target="_blank">empbilly@gmail.com</a>> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">Hello Greg,</div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Why doesn't bind work with networks/subnets in the conventional way?<br></div></div></div></blockquote><div><br></div><div>It does.</div><br><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">If the private subnet is <a href="http://10.60.0.0/23" target="_blank">10.60.0.0/23</a>, then it means that the address range is 10.60.0.1 to 10.60.1.254.<br></div></div></div></blockquote><div><br></div><div>That’s wrong. <a href="http://10.60.0.0/23" target="_blank">10.60.0.0/23</a> means 10.60.0.0 to 10.60.1.255 range.</div><br><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">How do I configure this ACL in named.conf.local so that it takes the whole range?</div></div></div></blockquote><div><br></div><div>Correctly specified range (without address/host bits) does takes the whole range.</div><div><br>Ondrej <br><div dir="ltr"><div>--</div>Ondřej Surý — ISC (He/Him)<div><br></div><div>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div><div><br></div></div></div><blockquote type="cite"><div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 24, 2022 at 9:31 AM Anand Buddhdev <<a href="mailto:anandb@ripe.net" target="_blank">anandb@ripe.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 24/08/2022 14:16, Elias Pereira wrote:<br>
<br>
Hi Elias,<br>
<br>
> Oh, sorry... :D<br>
> <br>
> here it is<br>
> <br>
> # cat named.conf.local<br>
> # ACL das redes internas<br>
> # Ultima modificação: 24/08/2022<br>
> <br>
> acl "internal" {<br>
> <a href="http://10.60.0.1/23" rel="noreferrer" target="_blank">10.60.0.1/23</a>;<br>
<br>
This is the issue. The address part of the prefix should be the lowest <br>
address in that prefix. If you change this to <a href="http://10.60.0.0/23" rel="noreferrer" target="_blank">10.60.0.0/23</a>, it will be <br>
fine. The same goes for all the other prefixes in your list. Change the <br>
1's to 0's.<br>
<br>
> <a href="http://10.10.1.1/24" rel="noreferrer" target="_blank">10.10.1.1/24</a>;<br>
> <a href="http://10.10.2.1/25" rel="noreferrer" target="_blank">10.10.2.1/25</a>;<br>
> <a href="http://10.10.3.1/25" rel="noreferrer" target="_blank">10.10.3.1/25</a>;<br>
> <a href="http://10.10.4.1/25" rel="noreferrer" target="_blank">10.10.4.1/25</a>;<br>
> <a href="http://10.10.5.1/25" rel="noreferrer" target="_blank">10.10.5.1/25</a>;<br>
> <a href="http://10.51.0.1/23" rel="noreferrer" target="_blank">10.51.0.1/23</a>;<br>
> <a href="http://10.10.6.1/25" rel="noreferrer" target="_blank">10.10.6.1/25</a>;<br>
> <a href="http://10.10.7.1/26" rel="noreferrer" target="_blank">10.10.7.1/26</a>;<br>
> <a href="http://172.20.0.1/26" rel="noreferrer" target="_blank">172.20.0.1/26</a>;<br>
> <a href="http://10.50.0.1/23" rel="noreferrer" target="_blank">10.50.0.1/23</a>;<br>
> <a href="http://10.40.0.1/22" rel="noreferrer" target="_blank">10.40.0.1/22</a>;<br>
> <a href="http://10.56.0.1/22" rel="noreferrer" target="_blank">10.56.0.1/22</a>;<br>
> };<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr">Elias Pereira</div>
<span>-- </span><br><span>Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list</span><br><span></span><br><span>ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" target="_blank">https://www.isc.org/contact/</a> for more information.</span><br><span></span><br><span></span><br><span>bind-users mailing list</span><br><span><a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a></span><br><span><a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a></span><br></div></blockquote></div></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr">Elias Pereira</div>
</div></blockquote></div><br></div>-- <br>Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br><br>ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" target="_blank">https://www.isc.org/contact/</a> for more information.<br><br><br>bind-users mailing list<br><a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br><a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br></div></blockquote></div><br></div></div>-- <br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div>
</div></blockquote></div><br></div></blockquote></div></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">Elias Pereira</div>