Sharpe, Sam J wrote:
2009/7/26 Craig White <craigwhite@xxxxxxxxxxx>:
On Sun, 2009-07-26 at 18:32 +0100, Sharpe, Sam J wrote:
2009/7/26 Sarkar, Kaushik <Kaushik.Sarkar@xxxxxxxxxx>:
Don’t know from where ifconfig getting netmask as 255.255.0.0 when I set it
for 255.255.255.0
I do...
root@kaushik_Fedora11 /> cat /etc/sysconfig/network-scripts/ifcfg-eth0
<snip>
NETMASK=255.225.255.0
Read that very very carefully... ;o)
I think because 255.225.255.0 is not a valid netmask, it's defaulting
to 255.255.0.0
(aren't a second pair of eyes wonderful!)
----
it's a valid netmask but it is one that is highly unlikely to work
because it appears to have a typo
No it isn't a valid netmask - that was my point - perhaps I should
have been clearer about the fact it has a typo and that's why it
wouldn't work.
A valid netmask is a set of 1s, followed by a set of 0s. The posted
netmask (with assumed typo) is:
11111111111000011111111100000000
That does not fit the definition of a netmask and it certainly can't
be mapped to a prefix, because the Prefix is calculated by the the
number of preceding 1s!
This sounds as if you are reversing the prefix and netmask definitions. A
netmask is anded with two IP addresses before they are compared, a prefix is as
you describe.
Consider:
iptables -A FORWARD -p tcp -s 10.5.12.0/255.255.252.192 -j ACCEPT
This relates to a CIDR block in 10.5.x.x where any packet coming from a server
(/24 IP ending 0..63) is accepted, packets from user machines are not. Thus user
machines do not have the same capabilities as servers, and users think they are
in a /24 subnet talking to their own servers.
Try this to verify it's valid:
iptables -A INPUT -p tcp -s 192.168.12.0/255.255.252.192 \
-j LOG --log-level debug --log-prefix "servr: "
iptables -L INPUT -nv
If you are about to make the point that this is a special use case, I agree, and
I'm sure in his case the 225 was a finger-check, agreed there. But netmask can
be useful in some cases where multiple rules would otherwise be needed.
--
Bill Davidsen <davidsen@xxxxxxx>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
