{"record":{"id":"fee2651cf4efd488","repo":"TechnitiumSoftware/DnsServer","slug":"network-access-control-list-cannot-have-more-than","errorCode":null,"errorMessage":"Network Access Control List cannot have more than 255 entries.","messagePattern":"Network Access Control List cannot have more than 255 entries\\.","errorType":"exception","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/DnsServer.cs","lineNumber":7821,"sourceCode":"                if ((value < ushort.MinValue) || (value > ushort.MaxValue))\n                    throw new ArgumentOutOfRangeException(nameof(DnsOverQuicPort), \"Port number valid range is from 0 to 65535.\");\n\n                if (value == 53)\n                    throw new ArgumentOutOfRangeException(nameof(DnsOverQuicPort), \"Port 53 cannot be used for DNS-over-QUIC service. Please use a different port.\");\n\n                _dnsOverQuicPort = value;\n            }\n        }\n\n        public IReadOnlyCollection<NetworkAccessControl> DnsReverseProxyNetworkACL\n        {\n            get { return _dnsReverseProxyNetworkACL; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                    _dnsReverseProxyNetworkACL = null;\n                else if (value.Count > byte.MaxValue)\n                    throw new ArgumentOutOfRangeException(nameof(DnsReverseProxyNetworkACL), \"Network Access Control List cannot have more than 255 entries.\");\n                else\n                    _dnsReverseProxyNetworkACL = value;\n            }\n        }\n\n        public string DnsTlsCertificatePath\n        { get { return _dnsTlsCertificatePath; } }\n\n        public string DnsTlsCertificatePassword\n        { get { return _dnsTlsCertificatePassword; } }\n\n        public string DnsOverHttpRealIpHeader\n        {\n            get { return _dnsOverHttpRealIpHeader; }\n            set\n            {\n                if (string.IsNullOrEmpty(value))\n                    _dnsOverHttpRealIpHeader = \"X-Real-IP\";","sourceCodeStart":7803,"sourceCodeEnd":7839,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/DnsServer.cs#L7803-L7839","documentation":"Thrown by the DnsReverseProxyNetworkACL setter when the supplied collection has more than byte.MaxValue (255) entries. The ACL is serialized with a single-byte length prefix (hence the 255 cap). A null or empty collection is allowed and clears the ACL; only an oversized non-empty collection throws ArgumentOutOfRangeException.","triggerScenarios":"Assigning DnsServer.DnsReverseProxyNetworkACL a non-empty collection with Count > 255. Reached via WebServiceSettingsApi.cs:1252/1254 settings update or DnsWebServiceLegacy.cs:518/524 ACL deserialization. Null or empty collections do NOT throw (they reset to null).","commonSituations":"Bulk-importing a large blocklist/CIDR list into the reverse-proxy ACL. Programmatically generating many per-client NetworkAccessControl entries and exceeding 255. Config restore from a host that had a very large ACL.","solutions":["Reduce the ACL to at most 255 entries — aggregate narrower CIDRs into broader ranges (e.g. merge /32s into a /24).","If you need more granular control, use a different filtering layer (zone ACLs, firewall rules) instead of this single-byte-indexed list.","Pass null or an empty collection to clear the ACL rather than a huge dummy list.","Validate Count <= 255 before assigning and trim/log the overflow entries."],"exampleFix":"// before\n_dnsServer.DnsReverseProxyNetworkACL = GeneratePerIpAcl(thousandsOfIps); // throws: > 255\n\n// after\nvar acl = AggregateToCidrs(thousandsOfIps);              // merge to <= 255 CIDRs\nif (acl.Count <= 255)\n    _dnsServer.DnsReverseProxyNetworkACL = acl;\nelse\n    _dnsServer.DnsReverseProxyNetworkACL = null;          // or split policy elsewhere","handlingStrategy":"validation","validationCode":"IReadOnlyCollection<NetworkAccessControl> acl = parsedAcl;\nif (acl is null || acl.Count == 0)\n    _dnsServer.DnsReverseProxyNetworkACL = null;\nelse if (acl.Count > byte.MaxValue)\n    _dnsServer.DnsReverseProxyNetworkACL = AggregateToCidrs(acl).Take(255).ToList();\nelse\n    _dnsServer.DnsReverseProxyNetworkACL = acl;","typeGuard":"static bool IsValidAcl(IReadOnlyCollection<NetworkAccessControl> acl) =>\n    acl is null || acl.Count == 0 || acl.Count <= byte.MaxValue;","tryCatchPattern":"try { _dnsServer.DnsReverseProxyNetworkACL = acl; }\ncatch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(DnsServer.DnsReverseProxyNetworkACL))\n{ _log.Warn($\"ACL had {acl.Count} entries (>255); aggregating\"); _dnsServer.DnsReverseProxyNetworkACL = AggregateToCidrs(acl); }","preventionTips":["Cap ACL imports at 255 entries or aggregate CIDRs first.","Use null/empty to clear the ACL, not a large placeholder list.","Move very large policies to firewall/zone ACLs instead of this byte-indexed list."],"tags":["dns","network","acl","reverse-proxy","configuration","argumentoutofrange"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}