diff --git a/hosts/fw.cloonar.com/modules/unbound.nix b/hosts/fw.cloonar.com/modules/unbound.nix
index 4eb366a..8ac1a39 100644
--- a/hosts/fw.cloonar.com/modules/unbound.nix
+++ b/hosts/fw.cloonar.com/modules/unbound.nix
@@ -4,7 +4,14 @@
     settings = {
       server = {
         interface = [ "0.0.0.0" "::0" ];
-        access-control = [ "127.0.0.0/8" "10.42.96.0/24" "10.42.97.0/24" "10.42.98.0/24" "10.42.99.0/24" "10.42.254.0/24" ];
+        access-control = [
+          "127.0.0.0/8 allow"
+          "10.42.96.0/24 allow"
+          "10.42.97.0/24 allow"
+          "10.42.98.0/24 allow"
+          "10.42.99.0/24 allow"
+          "10.42.254.0/24 allow"
+        ];
         tls-cert-bundle = "/var/lib/acme/fw.cloonar.com/fullchain.pem";
         local-zone = "\"cloonar.com\" transparent";
         local-data = [