0

I added this rule in iptables

iptables -A INPUT -s 192.168.0.100/24 -p tcp --dport 27 -j ACCEPT

To my surprise, when I list the iptables rules, i see this: source value became

192.168.0.0/24

Why?

  • 1
    192.168.0.100/24 and 192.168.0.0/24 represent the same set of addresses – Torin Apr 3 at 16:49
  • Though slightly confusing but makes sense. Can you please point me to documentation where you saw that iptables assumes them to be same set of address. As according to my understanding it should consider them differently. – pzk Apr 3 at 16:58
  • 1
    It is neither about iptables nor Unix, it is about having networking basic concepts. 192.168.0.100/32 is 192.168.0.100, 192.168.0.100/24 maps to 192.168.0.0; it is /number_of bits – Rui F Ribeiro Apr 3 at 17:01
  • @derobert Please do feel free to answer, busy at work atm. – Rui F Ribeiro Apr 3 at 17:07
  • 1
    @RuiFRibeiro done, I hope it makes sense to OP. – derobert Apr 3 at 17:27
2

192.168.0.100/24 can be a shorthand for 192.168.100/255.255.255.0 - configuring a device with the IP address 192.168.0.100 and the netmask 255.255.255.0. That's probably what you're expecting; but that's not how iptables is using it. If you just want to accept that particular host, and not the entire network, leave off the mask (or use /32, which is the same thing).

Strictly speaking, according to the manpage, it could spit out an error:

  [!] -s, --source address[/mask][,...]
          Source specification. Address can be either a network name, a hostname, a  network
          IP  address  (with  /mask), or a plain IP address. Hostnames will be resolved once
          ⋮

A mask can only go with a "network IP address", and 192.168.0.100 is not one (for a /24 network). The network address is what it's giving back to you — 192.168.0.0/24.

That raises the question: what is a network IP address?

A device/computer needs to know if another address is on the same network (and thus it can communicate directly) or if its on a different network (thus it needs to go through the gateway). The way this works is that a range of IP addresses are considered on the same network based on the network address, the netmask and some binary arithmetic. To find the network a given IP address is on you do a binary-and against the netmask (you line up the two addresses in binary and if both are 1, you write down a 1; otherwise, 0). Since netmasks always a bunch of 1s followed by some 0s, we abbreviate them by counting the number of 1s. A /24 means 24 1s and 8 0s (IPv4 is 32 bits long).

  (192)    (168)    (0)      (100)
  11000000 10101000 00000000 01100100
& 11111111 11111111 11111111 00000000
= 11000000 10101000 00000000 00000000  = 192.168.0.0

And you'll notice that if you try this with 192.168.0.1–255, they all come to the same answer: that is why they are considered on the same network.

  • Thanks for the elaborate explanation. @ derobert Bottomline iptables does not honour subnet mask /24 correct? – pzk Apr 3 at 17:34
  • @pzk the point of the answer is that there is nothing to honour – Rui F Ribeiro Apr 3 at 18:13
  • Took the liberty to make a small edit for the benefit of the OP, if you do not mind. – Rui F Ribeiro Apr 3 at 18:17
  • @RuiFRibeiro thank you, don't mind at all – derobert Apr 3 at 18:25
  • @pzk -s can match against a single host/IP address (if you do not give a mask) or it can match against a network (if you give the network address and a mask, e.g., /24). You gave it a non-network address and a mask — it "helpfully" converted it to the network address for you, instead of returning an error (or even worse, silently never matching, because that isn't a network address) – derobert Apr 3 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.