2

For example, in AWS security groups, we speicfy a IP address that can login, but then we put /24 or /32 for IPv6

Is that the only reason for specifying the cidr range, or can we do more configuration?

e.g. From source: 32.232.232.11/24. why have the 24 in there?

3 Answers3

12

You can think of IP address as 4 8bit numbers, divided by dots.

32.232.232.11/24

The number after the slash (/ sign) represents # of "significant" bits, that are included in the network. In your case - 24 essentially means that for this CIDR block first 3 numbers (8*3=24) are "significant" and the rest can be anything.

32.232.232.11/24 includes all addresses between 32.232.232.0 and 32.232.232.255

32.232.232.11/24 and 32.232.232.222/24 essentially interpreted the same. The last number is not significant.

32.232.232.11/16 would include everything between 32.232.0.0 and 32.232.255.255

In 32.232.232.11/32 all 32 bits counts, which leaves only one address 32.232.232.11 in this mask.

0.0.0.0/0 has zero significant bits and basically includes the entire IPv4 address space.

There are few IP ranges that are reserved for private networks 10.x.x.x, 172.x.x.x and 198.162.x.x that might look familiar from VPCs or your home network.

In AWS VPC you'll frequently see CIDR ranges like 10.0.0.0/16 for VPC and 10.0.1.0/24 for subnets.

The rest of IPv4 address space is usually assumed to be the public internet and besides 32.232.232.11/32 (single, specific IP address) and 0.0.0.0/0 - "open to the world" you rarely see other types of ranges.

Anton
  • 3,587
  • 2
  • 12
  • 27
1

If you want to allow the whole IP range in the security groups, then it's better to specify the CIDR (/24 in your case), because:

By specifying the CIDR of 24 you are whitelisting 256 IP addresses (starting from 32.232.232.0 to 32.232.232.255), so assume if you are adding these individually which will be a time taking task and it will also exhaust the AWS security groups rules limits because by default AWS security groups have the limit of 60 rules for inbound rules and 60 for outbound. So, it's better to specify the CIDR when allowing IP addresses.

If you only want to whitelist single IP address '32.232.232.11', then you should use the CIDR (/32) e.g 32.232.232.11/32 which will only whitelist 32.232.232.11.

Maaz
  • 91
  • 3
  • ah ok. Thank you. Jus to clarify 32.232.232.11/24 will open up the Inbound IP for 32.232.232.0 - 32.232.232.255. Whereas 32.232.232.11/32 will just open up that specific IP? –  Jan 28 '20 at 13:35
  • Got it: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-security-groups.html Source or destination: The source (inbound rules) or destination (outbound rules) for the traffic. Specify one of these options: An individual IPv4 address. You must use the /32 prefix length; for example, 203.0.113.1/32. An individual IPv6 address. You must use the /128 prefix length; for example 2001:db8:1234:1a00::123/128. A range of IPv4 addresses, in CIDR block notation, for example, 203.0.113.0/24. A range of IPv6 addresses, in CIDR block notation –  Jan 28 '20 at 13:40
0

CIDR is the short for Classless Inter-Domain Routing, an IP addressing scheme that replaces the older system based on classes A, B, and C. A single IP address can be used to designate many unique IP addresses with CIDR. A CIDR IP address looks like a normal IP address except that it ends with a slash followed by a number, called the IP network prefix. CIDR addresses reduce the size of routing tables and make more IP addresses available within organizations.

For your example, you get the range described below. 

CIDR Range  32.232.232.11/24
Netmask 255.255.255.0
Wildcard Bits   0.0.0.255
First IP    32.232.232.0
Last IP 32.232.232.255
Total Host  256

See https://www.ipaddressguide.com/cidr

Rodrigo Murillo
  • 13,080
  • 2
  • 29
  • 50
  • hi, ty. I understand CIDR ranges, but why do we have to specify it for a inbound IP Address? e.g. 32.232.232.11/24 . We're specifying a specific IP address, not a range, but yet we still have to say /24. –  Jan 28 '20 at 13:33
  • @PeterLai If you want to supply a specific IP address of 32.232.232.11, representing a single host, then you have to use 32.232.232.11/32. If you want to supply a range of IP addresses then use anything from /16 down to /31. Security Group rules require a CIDR, not an IP address. 32.232.232.11 is not a CIDR. – jarmod Jan 28 '20 at 13:46