diff --git a/etc/unbound/unbound.conf.d/access-control b/etc/unbound/unbound.conf.d/access-control
new file mode 100644
index 00000000..d7afa1de
--- /dev/null
+++ b/etc/unbound/unbound.conf.d/access-control
@@ -0,0 +1,9 @@
+# Listen on public interfaces
+interface: 0.0.0.0
+# NOTE! `sysctl net.ipv6.bindv6only=1`
+interface: ::
+
+# Allow connecting from
+access-control: 10.0.0.0/8 allow
+access-control: 172.16.0.0/16 allow
+access-control: 192.168.0.0/16 allow