diff --git a/etc/unbound/unbound.conf b/etc/unbound/unbound.conf
index 99a410e..f5a23dc 100644
--- a/etc/unbound/unbound.conf
+++ b/etc/unbound/unbound.conf
@@ -22,6 +22,8 @@ include-toplevel: "/etc/unbound/unbound.conf.d/*.conf"
 
     # addresses from the IP range that are allowed to connect to the resolver
     access-control: 192.168.88.0/24 allow
+    # explicitly allow localhost access
+    access-control: 127.0.0.0/8 allow
     # allow Tailnet
     access-control: 100.64.0.0/10 allow
     # uncomment the following line to allow Tailnet IPv6