From f55f0d6c7ecfc2a40dd73dc8252fde691818f189 Mon Sep 17 00:00:00 2001
From: Peter Palfrader <peter@palfrader.org>
Date: Wed, 17 Apr 2013 09:15:31 +0200
Subject: [PATCH] Try this

---
 modules/unbound/manifests/init.pp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/unbound/manifests/init.pp b/modules/unbound/manifests/init.pp
index 06395fc9c..aa63a5d6c 100644
--- a/modules/unbound/manifests/init.pp
+++ b/modules/unbound/manifests/init.pp
@@ -10,6 +10,7 @@ class unbound {
 
 	$is_recursor   = getfromhash($site::nodeinfo, 'misc', 'resolver-recursive')
 	$client_ranges = hiera('allow_dns_query')
+	$empty_client_range = empty($client_ranges)
 	$ns            = hiera('nameservers')
 
 	package { 'unbound':
@@ -55,7 +56,7 @@ class unbound {
 		notify  => Service['unbound']
 	}
 
-	if ($is_recursor and not empty($client_ranges)) {
+	if ($is_recursor and not $empty_client_range) { 
 		@ferm::rule { 'dsa-dns':
 			domain      => 'ip',
 			description => 'Allow nameserver access',
-- 
2.20.1