Configuring ACL (Access Control List)

An ACL in the context of network administration is a set of rules that control network traffic and limit access to networks and network resources based on predefined criteria. In DNS servers like ISC BIND, ACLs are used to define which clients (based on IP addresses or networks) are allowed or denied access to certain DNS services. Common uses of ACLs in DNS include:

1. Restricting Query Access: Defining which clients are allowed to query the DNS server.
2. Controlling Zone Transfers: Specifying which secondary servers are allowed to receive zone data from the primary server.
3. Limiting Dynamic Updates: Controlling which clients can dynamically update DNS records, often used in conjunction with TSIG for secure DDNS.

ACLs allow for the implementation of security policies by controlling who can access the DNS server and what actions they can perform, which is critical for maintaining the integrity and security of the DNS infrastructure.

Managing ACL templates

ACL templates are predefined configurations that simplify the creation of Access Control Lists (ACLs) in various network services, including DNS and DHCP servers. An ACL template allows administrators to define a set of rules or criteria once and then apply them across multiple instances, reducing redundancy and potential for error in configurations.

Usage of ACL Templates

ACL templates are typically used in environments where the same access restrictions or permissions are needed across different zones, views, or services. Instead of defining the same ACL multiple times, a template is created once and then referenced wherever needed.

They can be applied gobally on the cluster level, within specific zones, views, or options. 

Defining Named ACLs

To create Named ACLs

• Go to DNS-> Config-> ACL
• Click on ADD ACL button on the right.
• You can choose the type of the ACL: ISC Format or Template based ACL.
• For the DDI Central template, just enter the IPv4/IPv6 addresses one by one in the allow and Deny lists.
  
  

• For the ISC format
  Follow the Example below:
  Here's an example of an ACL in ISC BIND format:
   

9. acl "internal-network" {
10.    192.168.0.0/24;        // An internal subnet in CIDR notation
11.    10.15.20.0/22;         // Another internal subnet in CIDR notation
12.    localhost;             // The keyword for the loopback address (127.0.0.1)
13.    localnets;             // A predefined match list for all local networks
14.    ! 192.168.0.100;       // Exclude a specific IP from the ACL
15.    2001:db8::/32;         // An IPv6 subnet in CIDR notation
16.    key "transfer-key";    // A TSIG key for secure transactions
17. };