Address ranges
Although you can define ranges of addresses, due to the way the mask operates, there are certain restrictions on the particular ranges that can be set. For any given address you can encompass neighboring addresses in blocks of either 2, 4, 8, 16, 32, 64, 128, etc. and these must fall on particular boundaries. For instance, if you wanted to define the local address range:
192.168.142.67 to 192.168.142.93
The closest single block to cover the range would be the 32 addresses from: 192.168.142.64 to 192.168.142.95.
The mask needed to accomplish this would be: 255.255.255.224
When you look at the mask in binary, the picture becomes a little clearer. The above mask has the form: 11111111.11111111.11111111.11100000
Ignoring the initial three octets, the final six zeroes of the mask would ensure that the 32 addresses from .64 (01000000) to .95 (01011111) would all be treated in the same manner. See Net masks - the binary explanation for details.
When defining a mask, the important rule to remember is: There must be no ‘ones’ to the right of a ‘zero’.
For instance, (ignoring the first three octets) you could not use a mask that had 11100110 because this would affect intermittent addresses within a range in an impractical manner. The same rule applies across the octets. For example, if you have zeroes in the third octet, then all of the fourth octet must be zeroes.
The permissible mask values (for all octets) are as follows:
Mask octet | Binary Number of addresses encompassed |
255111111111 address
254111111102 addresses
252111111004 addresses
248111110008 addresses
2401111000016 addresses
2241110000032 addresses
1921100000064 addresses
12810000000128 addresses
0 00000000256 addresses
If the access control range that you need to define is not possible using one address and one mask, then you could break it down into two or more entries. Each of these entries could then use smaller ranges (of differing sizes) that, when combined with the other entries, cover the range that you require.
For instance, to accurately encompass the range in the earlier example: 192.168.142.67 to 192.168.142.93
You would need to define the following six address / mask combinations in the IP access control section:
Network/address entry | Mask entry | |
192.168.142.67 | 255.255.255.255 defines 1 address (.67) | |
192.168.142.68 | 255.255.255.252 defines 4 addresses (.68 to .71) | |
192.168.142.72 | 255.255.255.248 defines 8 addresses (.72 to .79) | |
192.168.142.80 | 255.255.255.248 defines 8 addresses (.80 to .87) | |
192.168.142.88 | 255.255.255.252 defines 4 addresses (.88 to .92) | |
192.168.142.93 | 255.255.255.255 defines 1 address (.93) | |
Mask
Enter an IP network mask that indicates the range of addresses that will be allowed or denied access. For instance, if only a single specified IP address were required, the mask entry would be 255.255.255.255 in order to specify a single location.