--- type: Setup Guide title: "How to Restrict SNMP OIDs with a VACM Allowlist" description: "Use net-snmp VACM views to expose only the OID subtrees a manager needs, so a leaked community or credential reveals almost nothing." resource: "https://snmp-monitoring.info/setup/oid-allowlist/" tags: [setup] timestamp: 2026-07-11T00:00:00Z --- # How to Restrict SNMP OIDs with a VACM Allowlist Use net-snmp VACM views to expose only the OID subtrees a manager needs, so a leaked community or credential reveals almost nothing. ## Related concepts - Up: [SNMP Setup & Configuration: Install, Secure & Test](/setup/index.md) ## Frequently asked questions ### How do I restrict which SNMP OIDs are readable? Define a VACM view listing the subtrees to expose — view included — then bind it to a group with an access line (or use rocommunity -V for the short form). Restart snmpd; anything outside the view returns no such object. ### What is VACM? VACM is the View-based Access Control Model, net-snmp's way of controlling which OID subtrees a requester may read. You group OIDs into a named view using included/excluded subtrees and attach that view to a security group, so each community or user sees only its authorised slice of the MIB. ### How do I limit a community to a view? The quickest way is rocommunity -V , which binds that community to the named view. For finer control use the full com2sec → group → access chain and reference the view in the access line's read column. ### What happens when I query an OID that's out of view? The agent returns No Such Object (or no response), exactly as if the OID didn't exist — even though it may be present on the device. VACM filters the response, so an out-of-view query yields no data, which is the whole point of the allowlist. ## Source Concept generated from https://snmp-monitoring.info/setup/oid-allowlist/ — the SNMP Monitoring vendor-neutral knowledge base. Content is limited to what that page states (no external claims added here).