View match-clients works only with subnet, not with single IP address

Question

I'm running Bind on OpenWrt 15.05.1 as DNS server. I wanted to set up multiple view, with different zones.

acl "trusted" {
        10.0.1.0/24;
        localhost;
        localnets;
};

acl "blacklisted" {
        10.0.1.10;
};

options {
        directory "/tmp";
        recursion yes;
        allow-recursion { trusted; };
        allow-transfer { none; };
        dnssec-validation auto;
        forwarders {
                8.8.8.8;
        };
        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

view "blacklist" {
        match-clients { blacklisted; };
        zone "example.com" { type master; file "/etc/bind/zones/db.example"; };
};

view "normal" {
        match-clients { any; };
        zone "." {
                type hint;
                file "/etc/bind/db.root";
        };
};

And it works well, but only if the IP address in "blacklisted" acl has a subnet at its end (like that: 10.0.1.10/28). But I'm trying to target only one IP, which is not working for some reason.

Thanks for replies.

Answer 1

update { any; } sections with

{ !blacklisted; any; } in your normal view

Answer 2

UPDATE:

You can specify single IP addrs.

IE

acl "someips" {
  10.0.0.1; 192.168.23.1; 192.168.23.15;
};

See this

Answer 3

for single ip in ACL, you can add /32 e.g 10.0.1.10/32