I added this rule in iptables
iptables -A INPUT -s 192.168.0.100/24 -p tcp --dport 27 -j ACCEPT
To my surprise, when I list the iptables rules, i see this: source value became
192.168.0.100/24 can be a shorthand for 192.168.100/255.255.255.0 - configuring a device with the IP address 192.168.0.100 and the netmask 255.255.255.0. That's probably what you're expecting; but that's not how iptables is using it. If you just want to accept that particular host, and not the entire network, leave off the mask (or use
/32, which is the same thing).
Strictly speaking, according to the manpage, it could spit out an error:
[!] -s, --source address[/mask][,...] Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once ⋮
A mask can only go with a "network IP address", and 192.168.0.100 is not one (for a /24 network). The network address is what it's giving back to you — 192.168.0.0/24.
That raises the question: what is a network IP address?
A device/computer needs to know if another address is on the same network (and thus it can communicate directly) or if its on a different network (thus it needs to go through the gateway). The way this works is that a range of IP addresses are considered on the same network based on the network address, the netmask and some binary arithmetic. To find the network a given IP address is on you do a binary-and against the netmask (you line up the two addresses in binary and if both are 1, you write down a 1; otherwise, 0). Since netmasks always a bunch of 1s followed by some 0s, we abbreviate them by counting the number of 1s. A /24 means 24 1s and 8 0s (IPv4 is 32 bits long).
(192) (168) (0) (100) 11000000 10101000 00000000 01100100 & 11111111 11111111 11111111 00000000 = 11000000 10101000 00000000 00000000 = 192.168.0.0
And you'll notice that if you try this with 192.168.0.1–255, they all come to the same answer: that is why they are considered on the same network.