Unit 2: Addresses and subnets · Lesson 1 of 7 · 15 min
Reading an address
Split an IPv4 address into its network and host parts and see which ranges are private.
mission
- You are
- The analyst writing the firewall request.
- Situation
- A firewall change asks to allow 10.20.0.11/24. The engineer approving it wants to know exactly which machines that covers.
- Goal
- Read a CIDR address and work out its network, its range and whether it is private.
- Hand in
- The netmask for a /27, for the next request in the queue.
Subnets as a mailroom
Reading CIDR notation
- 1
10.20.0network part: the first 24 bits - 2
11host part: the last 8 bits - 3
24prefix length: 24 bits of network, mask 255.255.255.0
Ask ipcalc
ipcalc -nb prints the network, the usable host range and the broadcast address without drawing the bits.
ipcalc -nb 10.20.0.11/24
Address: 10.20.0.11
Netmask: 255.255.255.0 = 24
Wildcard: 0.0.0.255
=>
Network: 10.20.0.0/24
HostMin: 10.20.0.1
HostMax: 10.20.0.254
Broadcast: 10.20.0.255
Hosts/Net: 254 Class A, Private Internet
you should see The rule really covers 10.20.0.1 to 10.20.0.254: the whole server room, not one server.
defender tip If a request names one server, the rule should say /32. A /24 where a /32 was meant is one of the most common firewall mistakes.
Private and reserved ranges
| Command | What it does |
|---|---|
10.0.0.0/8 | Private. Never routed on the internet |
172.16.0.0/12 | Private |
192.168.0.0/16 | Private |
127.0.0.0/8 | Loopback, this machine only |
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | Reserved for documentation. In this course they stand in for internet addresses |
Check a single host rule
A /32 has a single address and no room for anything else.
ipcalc -nb 10.20.0.11/32 | grep -E 'Netmask|Hosts'
Netmask: 255.255.255.255 = 32
Hosts/Net: 1 Class A, Private Internet
you should see One host.
Test which addresses are private
The private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The middle one is the easiest to get wrong.
python3 -c "import ipaddress as i; [print(a, i.ip_address(a).is_private) for a in ['10.20.0.11', '172.31.255.1', '172.32.0.1', '192.168.1.10']]"
10.20.0.11 True
172.31.255.1 True
172.32.0.1 False
192.168.1.10 True
you should see 172.31.255.1 is private, 172.32.0.1 is not: the /12 ends at 172.31.
defender tip Firewall rules that say 172.0.0.0/8 when they mean 172.16.0.0/12 trust a large slice of the public internet.
Change the prefix, change the network
The same address with a shorter prefix belongs to a much bigger network.
ipcalc -nb 10.20.0.11/16 | grep -E 'Network|Hosts'
Network: 10.20.0.0/16
Hosts/Net: 65534 Class A, Private Internet
you should see With /16, 10.20.0.11 sits in 10.20.0.0/16 alongside 65534 possible hosts.
defender tip Always read an address with its prefix. 10.20.0.11 alone does not tell you who it can reach without a router.
What a defender takes away
- 1The prefix length says how many bits name the network. The rest number the hosts.
- 2Check every firewall rule's prefix against what was really asked for.
- 310.x, 172.16 to 31.x and 192.168.x never appear on the public internet.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.