Routing, DNS, and privacy

Read private addresses and CIDR routes

Identify private IPv4 ranges and read a CIDR prefix as the set of destination addresses a route can match.

8 minute lesson

~~~

Private IPv4 networks commonly use 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. RFC 1918 reserves these ranges for private use, and Internet routers do not carry them. That fact is why VPNs exist at all: the only way to reach a private address from outside is through some kind of tunnel.

The notation is CIDR. The number after the slash says how many leading bits identify the network. The remaining bits identify hosts inside it:

10.14.0.0/24   →  10.14.0.0 – 10.14.0.255       (256 addresses)
10.14.0.0/16   →  10.14.0.0 – 10.14.255.255     (65,536 addresses)
10.0.0.0/8     →  10.0.0.0  – 10.255.255.255    (16,777,216 addresses)

A /24 contains a much smaller range than a /8. The bigger the number after the slash, the smaller the network. That inversion trips up everyone once.

Routes are CIDR prefixes with a direction attached. When several routes match a destination, the kernel picks the most specific one — the longest prefix wins. You can ask which route a given address would take:

ip route get 10.14.0.7
# 10.14.0.7 dev wg0 src 10.14.0.2

ip route get 10.15.0.7
# 10.15.0.7 via 192.168.1.1 dev eth0 src 192.168.1.34

The first address matched the tunnel’s /24 route. The second matched nothing specific and fell through to the default route.

VPN routes often point one private prefix into the tunnel. Use the narrowest prefix that covers the intended resources. Routing all of 10.0.0.0/8 into a tunnel to reach one server at 10.0.1.100 drags sixteen million addresses along for no reason, and every one of them is a potential collision with some other network.

Collisions are the classic failure. Overlapping home and company ranges cause ambiguity: if both use 192.168.1.0/24, the operating system cannot know which 192.168.1.20 you meant. Longest-prefix matching resolves it mechanically, and you get the printer when you wanted the server. The only clean fixes are renumbering one side or picking unusual ranges from the start — which is exactly why our lab uses 10.14.0.0/24 instead of something popular.

Lesson completed

Take this course offline

Get every free book and course as PDF and EPUB files.

Get the download library →