@emotional_soup_88__dup_21417@programming.dev

The behavior of /24 vs /32 addresses when using iptables

2026-03-03 16:46 UTC

I added a rule to accept connections from 192.168.1.135/24, since my router is configured to hand out /24 addresses. Then, iptables -L -v showed that connections from 192.168.1.0/24 are accepted. When I change the rule to accept connections from .135/32 - or from .135 without specifying the subnet -, it not only works as intended, but it also resolves the hostname correctly. Why? unsolicited “why do you still use iptables” advice not welcome :D

Replies (4)

@hyacin@lemmy.ml 2026-03-03 16:59

They’re not "/24 addresses, it’s a mask. /32 references one specific host, it is a mask of all 1s. /24 references 255 hosts, it is a mask of 75% 1s and 25% 0s. www.geeksforgeeks.org/…/role-of-subnet-mask/

Open ##508079
@jrgd@lemmy.zip 2026-03-03 17:01

The routing and firewalling is a bit different in terms of why certain CIDR masks are used. For the router, the /24 prefix is usually defined for itself on the LAN interface to denote the address space it may send route information to, and what addresses are controlled by the device. Almost certainly, (unless using a lower CIDR range and actually handing out /24 blocks to subsequent routers), you are granting /32 IPv4 addresses to your device from your router. For your system firewall, 192.168.1.135/24 is identical to 192.168.1.0/24 as they are the same address space. You’re simply allowing from a subnet of hosts to accept from. Given the /24 mask is 255.255.255.0, it does not matter what the last number of the IPv4 address is, but the lowest possible number to match the mask is standard form. Without knowing what rule(s) specifically are being applied, I couldn’t tell you if your firewall rules are something that would affect hostname resolution of other hosts from your system or not.

Open ##508083
@kittykillinit@lemy.lol 2026-03-04 03:08

Fuck this shit is so complicated.

Open ##511822
@PowerCrazy@lemmy.ml 2026-03-04 05:08

You need to understand subnetting. Allowing 192.168.1.0/24 also allows 192.168.1.135/24 In fact 192.168.1.135/24 shouldn’t be valid syntax at all, but it is easier to accept it and then let subnet math fix the mistake. I assume your router is 192.168.1.135 for whatever reason, so as long as your router is contained in the configured iptables allowed network, it’ll work with all of the following networks. 192.168.1.135/32 192.168.1.134/31 192.168.1.132/30 192.168.1.128/29 192.168.1.128/28 192.168.1.128/27 192.168.1.128/26 192.168.1.128/25 192.168.1.0/24 192.168.0.0/23 … And 22 even larger networks. If you don’t configure a subnet mask for the rule, iptables will accept the IP address you put in as a single host, the /32 is implied. The same behavior would be seen using any kind of network filter, though they may not allow you to specify 192.168.1.135/24, they may require a bit boundary, but mathematically, it’s the same.

Open ##512280