{"record":{"id":"07907a83d00835e6","repo":"TechnitiumSoftware/DnsServer","slug":"network-acl-cannot-have-more-than-255-entries","errorCode":null,"errorMessage":"Network ACL cannot have more than 255 entries.","messagePattern":"Network ACL cannot have more than 255 entries\\.","errorType":"validation","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Zones/ApexZone.cs","lineNumber":1287,"sourceCode":"                    {\n                        if (_overrideCatalogQueryAccess)\n                            catalogZone.SetAllowQueryProperty(GetQueryAccessACL(), _name); //update member zone custom property\n                        else\n                            catalogZone.SetAllowQueryProperty(null, _name); //remove member zone custom property\n                    }\n                }\n            }\n        }\n\n        public IReadOnlyCollection<NetworkAccessControl> QueryAccessNetworkACL\n        {\n            get { return _queryAccessNetworkACL; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                    _queryAccessNetworkACL = null;\n                else if (value.Count > byte.MaxValue)\n                    throw new ArgumentOutOfRangeException(nameof(QueryAccessNetworkACL), \"Network ACL cannot have more than 255 entries.\");\n                else\n                    _queryAccessNetworkACL = value;\n            }\n        }\n\n        public virtual AuthZoneTransfer ZoneTransfer\n        {\n            get { return _zoneTransfer; }\n            set\n            {\n                _zoneTransfer = value;\n\n                //update catalog zone property\n                if (this is CatalogZone thisCatalogZone)\n                {\n                    //update global custom property\n                    thisCatalogZone.SetAllowTransferProperty(GetZoneTranferACL());\n                }","sourceCodeStart":1269,"sourceCodeEnd":1305,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Zones/ApexZone.cs#L1269-L1305","documentation":"Thrown by the QueryAccessNetworkACL setter when the supplied NetworkAccessControl collection has more than byte.MaxValue (255) entries. Null/empty is allowed (clears the ACL); anything above 255 is rejected because the ACL is persisted with a single-byte count.","triggerScenarios":"Assigning a query-access ACL with > 255 network rules; importing a large ACL from another system.","commonSituations":"Granular per-subnet allow/deny lists that grew over time; merging multiple ACL sources.","solutions":["Reduce QueryAccessNetworkACL to <= 255 entries by aggregating subnets (e.g. combine /24s into a /16).","Move broad allow/deny logic to upstream firewall rules instead of the zone ACL.","Deduplicate overlapping rules before assigning."],"exampleFix":"// before\nzone.QueryAccessNetworkACL = allRules; // Count > 255 -> throws\n// after\nzone.QueryAccessNetworkACL = AggregateSubnets(allRules).Take(255).ToList();","handlingStrategy":"validation","validationCode":"if (acl != null && acl.Count > byte.MaxValue)\n    throw new InvalidOperationException($\"QueryAccessNetworkACL capped at 255 entries (got {acl.Count}).\");\nzone.QueryAccessNetworkACL = acl;","typeGuard":"static bool IsValidAclCount(IReadOnlyCollection<NetworkAccessControl> acl) => acl is null || acl.Count <= byte.MaxValue;","tryCatchPattern":"try { zone.QueryAccessNetworkACL = acl; }\ncatch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(zone.QueryAccessNetworkACL))\n{ zone.QueryAccessNetworkACL = AggregateSubnets(acl).Take(byte.MaxValue).ToList(); }","preventionTips":["Aggregate fine-grained subnets into broader CIDRs before assigning.","Enforce the 255 cap at the configuration UI.","Offload broad allow/deny to the network firewall when possible.","Deduplicate overlapping ACL rules."],"tags":["dns","acl","network","validation","zone-management"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}