bind9 force to listen only on local addresses

Question

I am not able to get bind9 listen only on localhost and a VPN-IP. It listens also on the public ip.

my config is:

listen-on port 53 { localhost; 10.8.0.1; };

netstat says (public IP is masked):

tcp 0 0 10.8.0.1:53 0.0.0.0:* LISTEN 1029/named

tcp 0 0 my.public.ip:53 0.0.0.0:* LISTEN 1029/named          

tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1029/named          

udp 0 0 my.public.ip:53 0.0.0.0:*     1029/named          

udp 0 0 127.0.0.1:53 0.0.0.0:*        1029/named          

udp 0 0 10.8.0.1:53  0.0.0.0:*        1029/named

How can I force bind9 to listen only on the local IP´s?

I don´t know what to do now.

Answer 1

Found out the solution by myself.

listen-on port 53 { 127.0.0.1; 10.8.0.1; };

did the trick.