IPv4 and IPv6 addressing, CIDR and subnets

Every interface on the firewall has an IP address, a CIDR prefix length, and (almost always) a gateway. Reading those values, and knowing what they mean, is the first skill the firewall operator must internalise.

IPv4 in 32 bits

An IPv4 address is 32 bits, conventionally written as four decimal octets separated by dots:

192.0.2.50  =  11000000.00000000.00000010.00110010

The CIDR prefix length tells you how many of those bits identify the network:

192.0.2.50/24  →  24-bit network portion, 8-bit host portion
192.0.2.50/26  →  26-bit network portion, 6-bit host portion

/24 is the most common: 256 addresses, of which 254 are usable for hosts (the lowest is the network address, the highest is the broadcast). /30 is the smallest useful subnet for a point-to-point link — two usable addresses, often used for firewall uplinks or CARP VIP segments.

$ ipcalc 192.0.2.50/26

Address:   192.0.2.50
Netmask:   255.255.255.192 = 11111111.11111111.11111111.11000000
Wildcard:  0.0.0.63
Network:   192.0.2.0/26
HostMin:   192.0.2.1
HostMax:   192.0.2.62
Broadcast: 192.0.2.63
Hosts/Net: 62

The netmask in dotted-decimal is the same number as the prefix length, just written in four octets: /24 is 255.255.255.0, /26 is 255.255.255.192. The wildcard mask is the inverse, used by ACLs and some firewall engines. OPNsense uses CIDR notation everywhere — the wildcard is internal.

Subnet sizing for firewall interfaces

A firewall interface is a subnet. The firewall owns one IP in that subnet (often the first or last usable address), and the LAN hosts get addresses out of the rest.

The mistake most operators make is to give every interface a /24 “for headroom” without thinking about whether the production environment will ever use those 253 addresses. A /25 (126 hosts) or a /26 (62 hosts) is fine for a small VLAN — and the unused addresses are then available for unrelated segments elsewhere.

IPv6 — bigger numbers, same idea

An IPv6 address is 128 bits, written as eight groups of four hex digits separated by colons:

2001:db8:0:0:0:0:0:1

Consecutive groups of zeros can be elided once, so the same address is:

2001:db8::1

CIDR works the same way:

2001:db8:1::/48  →  organisation
2001:db8:1:1::/64 →  subnet (a /64 is the smallest subnet
                      almost every network uses)
2001:db8:1:1::1/64 →  host

The most important rule for IPv6 is a /64 is the smallest subnet a host expects to see on a LAN. SLAAC and IPv6 router advertisements assume /64. If you configure a smaller prefix on a LAN interface, SLAAC will not work, IPv6 autoconfiguration will not work, and hosts will fall back to link-local only.

$ sipcalc 2001:db8:1:1::1/64

-[ipv6 : 2001:db8:1:1::1/64]-

Network address....................: 2001:db8:1:1::
Network mask.......................: ffff:ffff:ffff:ffff::
Network mask (in bits).............: 64
Network range......................: 2001:db8:1:1::
- 2001:db8:1:1:ffff:ffff:ffff:ffff
Number of hosts in network.........: 18446744073709551616

The number of hosts in a /64 is enormous. IPv6 was designed for hosts to have multiple addresses — link-local, global, privacy, multicast — so the address space is not the constraint. The constraint is operational: keep the prefix length consistent with the protocol assumptions.

Why the firewall operator uses this every day

Every interface on OPNsense is a CIDR block plus an IP. Every firewall rule has a source and destination that are CIDR blocks or IPs. Every alias you build will probably be a CIDR block or a table of CIDR blocks. Every NAT entry has a CIDR block for “external address” and another for “internal address”. Knowing how to compute 192.0.2.0/24’s broadcast and usable range — and to spot a typo where someone meant /24 and typed /26 — is a core skill.