---
title: "My BIND 9 access controls don't do what I expect"
slug: "aa-00419"
description: "The built-in BIND Access Control List (ACL) localhost matches the IPv4 and IPv6 addresses of all network interfaces on the system."
updated: 2018-10-15T13:42:57Z
published: 2018-10-15T13:42:57Z
canonical: "kb.isc.org/aa-00419"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.isc.org/llms.txt
> Use this file to discover all available pages before exploring further.

# My access controls using default ACL localhost don't do quite what I expect.

The built-in BIND Access Control List (ACL) **localhost** matches the IPv4 and IPv6 addresses of all network interfaces on the system - it doesn't mean **127.0.0.1** only.

The ACL **localnets** matches any host on an IPv4 or IPv6 network for which the system on which **named** is running has an interface.

(See the BIND [Administrator Reference Manual](https://kb.isc.org/docs/aa-01031) for details of other built-in ACLs).