I'm running Bind on OpenWrt 15.05.1 as DNS server. I wanted to set up multiple view, with different zones.

acl "trusted" {;

acl "blacklisted" {;

options {
        directory "/tmp";
        recursion yes;
        allow-recursion { trusted; };
        allow-transfer { none; };
        dnssec-validation auto;
        forwarders {
        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };

view "blacklist" {
        match-clients { blacklisted; };
        zone "example.com" { type master; file "/etc/bind/zones/db.example"; };

view "normal" {
        match-clients { any; };
        zone "." {
                type hint;
                file "/etc/bind/db.root";

And it works well, but only if the IP address in "blacklisted" acl has a subnet at its end (like that: But I'm trying to target only one IP, which is not working for some reason.

Thanks for replies.

  • Can you be more specific about how it doesn't work? Also, what address is in this context? Based on how you use it with match-destinations I gather it must be one of the addresses of the nameserver? Commented Jan 24, 2017 at 22:03
  • I don't know of openwrt binds all interfaces, you might want to make sure you're only recursive internally Commented Jan 24, 2017 at 22:11
  • you can also use match-client in the zone config Commented Jan 24, 2017 at 22:12
  • @PepinCZ Please confirm what the actual intention of using match-destinations was. If the solution is to change the client address matching it seems that maybe you meant to use match-clients all along? (Which may make for a more straightforward solution) Commented Jan 24, 2017 at 22:20
  • @HåkanLindqvist in this scenario match-clients was ment to be there. I just wrote it as an example (because the question was about Bing ignoring the "blacklist" view).
    – user319725
    Commented Jan 24, 2017 at 22:24

3 Answers 3


update { any; } sections with

{ !blacklisted; any; } in your normal view

  • This is not what I want. I just want to serve different zone files to "blacklisted". And /32 subnet doesn't work neither. But /28, for example, work perfectly how I want.
    – user319725
    Commented Jan 24, 2017 at 21:57
  • list the zone in both views if you need it in both views, clients only go into one view Commented Jan 24, 2017 at 21:58
  • that isn't the problem. If I use /28 subnet (, it works as expected. But when I just enter the IP or /32, the "blacklist" view just gets ignored for some reason.
    – user319725
    Commented Jan 24, 2017 at 22:00
  • updated, sorry wrong bracket section Commented Jan 24, 2017 at 22:02
  • 1
    Amazing! Thanks! Now it works exactly as I wanted! Thank you so much. But I'm still curious why it requires that thought...
    – user319725
    Commented Jan 24, 2017 at 22:06


You can specify single IP addrs.


acl "someips" {;;;

See this

  • I actually tried that, but it has the same effect as without /32. It just doesn't work.
    – user319725
    Commented Jan 24, 2017 at 21:55

for single ip in ACL, you can add /32 e.g

  • 3
    OP mentioned this doesn't work for him.
    – Sven
    Commented Jul 31, 2019 at 7:42

You must log in to answer this question.