36
The behavior of /24 vs /32 addresses when using iptables (programming.dev)
submitted 8 months ago by to c/linux@lemmy.ml
16 comments fedilink hide all child comments
 

I added a rule to accept connections from 192.168.1.135/24, since my router is configured to hand out /24 addresses. Then, iptables -L -v showed that connections from 192.168.1.0/24 are accepted. When I change the rule to accept connections from .135/32 - or from .135 without specifying the subnet -, it not only works as intended, but it also resolves the hostname correctly.

Why?

unsolicited "why do you still use iptables" advice not welcome :D

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 8 months ago* (last edited 8 months ago) (2 children)

I'm not sure how useful this is, but it helped me understand.

The subnet mast is the count of the bits from the front that matter.

This is useful for switches and network equipment that only have to look at that much if the packet and route it quickly.

So a 10.0.0.0/8 address the switch only looks at the first 8 binary digits (also called an octet) and routes it based on that.

This also works for non multiple of 8 masks, as it's an operation done on a binary level (it's a mask using a binary AND so only bits that are true and.the mask can be matter)

10.192.0.0/10

IP: 00001010.11000000.00000000.00000000

Mask: 11111111.11 000000.00000000.00000000

So 10.192.0.1 and 10.192.255.255 look the same with their mask on

1: 00001010.11 000000.00000000.00000001

255: 00001010.11 111111.11111111.11111111

Mask: 11111111.11 000000.00000000.00000000

Result for both is: 00001010.11 000000.00000000.00000000

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •