Knowledge Base

Why Use IP Subnet in a Firewall?

The main purpose of using IP subnets in firewalls is to control network traffic in a more granular way. Subnets divide a large IP address block into smaller, manageable pieces. This allows you to define specific rules for devices in a particular subnet, determining which resources they can access or what type of traffic they can send.

• Security: You can isolate subnets containing sensitive data, preventing unauthorized access.
• Performance: By segmenting network traffic, you can reduce network congestion and improve performance.
• Manageability: Smaller subnets make network management and troubleshooting easier.

For example, a company's accounting department and marketing department may be on different subnets. The accounting department's subnet may only be granted access to specific servers, while the marketing department's subnet may be granted broader access.

What is an IP Subnet and How Does it Work?

An IP subnet is a logically divided part of an IP network. Subnets are defined using an IP address and a subnet mask. The subnet mask specifies which bits of the IP address represent the network address and which bits represent the host address.

For example, the 192.168.1.0/24 IP block has a network address of 192.168.1.0 and a subnet mask of 255.255.255.0. The "/24" notation indicates that the first 24 bits of the subnet mask are "1". This means that the first 24 bits of the IP address (192.168.1) represent the network address, and the last 8 bits represent the host address. This subnet has 254 available host addresses (192.168.1.1 - 192.168.1.254).

You can review the table below for a better understanding of the subnet mask:

When a device is configured with an IP address and a subnet mask, it can determine whether the destination IP address is on the same subnet. If the destination IP address is on the same subnet, the device can send data directly to the destination. If the destination IP address is on a different subnet, the device sends the data to the default gateway. The gateway routes traffic between different subnets.

How to Define IP Subnet Based Rules in a Firewall?

Defining IP subnet-based rules in a firewall typically involves the following steps:

1. Log in to the Firewall: Access the firewall's management interface via a web browser or using a protocol like SSH.
2. Go to the Rule Section: Find the rule management section of the firewall. This section is often named "Firewall", "Security Rules", "Access Control", etc.
3. Create a New Rule: Click the option to create a new rule.
4. Define Source: Specify which subnet the rule will affect traffic from. You can specify a subnet address (e.g., 192.168.1.0/24) or an IP address range (e.g., 192.168.1.10 - 192.168.1.50) as the source.
5. Define Destination: Specify which subnet or IP address the rule will affect traffic going to.
6. Define Service: Specify which protocol (e.g., TCP, UDP, ICMP) and port number (e.g., 80, 443, 22) the rule will affect traffic flowing through.
7. Define Action: Specify what the rule will do to the traffic. There are usually options like "Allow", "Deny", or "Reject". "Allow" allows traffic, while "Deny" and "Reject" block traffic. "Reject" also sends an error message to the sender.
8. Save and Activate the Rule: After saving the rule, don't forget to activate it. Some firewalls automatically activate rules, while others may require you to activate them manually.

Example: To create a rule that allows traffic from the 192.168.1.0/24 subnet to access the web server at 10.0.0.10 (ports 80 and 443), you can follow these steps:

1. Log in to the firewall.
2. Go to the rule management section.
3. Create a new rule.
4. Specify 192.168.1.0/24 as the source.
5. Specify 10.0.0.10 as the destination.
6. Specify TCP ports 80 and 443 as the service.
7. Select "Allow" as the action.
8. Save and activate the rule.

Examples of Subnet Definition in Different Firewall Products

Different firewall products may use different interfaces and commands for subnet definition. Here are some examples of subnet definition in popular firewall products:

Cisco ASA

object network WEB_SERVER
 host 10.0.0.10
object network INTERNAL_NETWORK
 subnet 192.168.1.0 255.255.255.0

access-list INSIDE_OUT extended permit tcp object INTERNAL_NETWORK object WEB_SERVER eq www
access-list INSIDE_OUT extended permit tcp object INTERNAL_NETWORK object WEB_SERVER eq https
access-group INSIDE_OUT in interface inside

In this example, two objects named "WEB_SERVER" and "INTERNAL_NETWORK" are first defined. The "WEB_SERVER" object represents the IP address 10.0.0.10, while the "INTERNAL_NETWORK" object represents the 192.168.1.0/24 subnet. Then, an access list named "INSIDE_OUT" is created, and this access list allows TCP traffic (ports 80 and 443) from the "INTERNAL_NETWORK" subnet to the "WEB_SERVER" address.

iptables (Linux Firewall)

iptables -A INPUT -s 192.168.1.0/24 -d 10.0.0.10 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -d 10.0.0.10 -p tcp --dport 443 -j ACCEPT

In this example, the "iptables" command is used to allow TCP traffic (ports 80 and 443) from the 192.168.1.0/24 subnet to the 10.0.0.10 address. The "-A INPUT" parameter specifies that the rule will affect incoming traffic. The "-s" parameter specifies the source IP address or subnet. The "-d" parameter specifies the destination IP address. The "-p" parameter specifies the protocol. The "--dport" parameter specifies the destination port number. The "-j ACCEPT" parameter specifies that traffic will be allowed.

pfSense

pfSense has a web-based interface. To define a subnet, go to the "Firewall" -> "Rules" section and create a new rule. In the rule creation screen, select "Network" as "Type" in the "Source" section and enter the subnet address (e.g., 192.168.1.0/24). In the "Destination" section, specify the destination IP address or subnet. In the "Protocol" and "Destination port range" sections, specify the relevant protocol and port numbers. Finally, select the "Pass" (allow) option in the "Action" section and save the rule.

Importance of IP Subnets in Terms of Security and Best Practices

IP subnets are an important tool for increasing network security. However, if they are not configured correctly, they can create security vulnerabilities. Here are some best practices to consider when using IP subnets:

• Create Subnets in a Planned Manner: Create subnets in a planned manner according to the needs of your network. For example, keep devices with sensitive data in a separate subnet.
• Apply the Principle of Least Privilege: Grant each subnet access only to the resources it needs. Avoid unnecessary access permissions.
• Regularly Review Firewall Rules: Regularly review and update firewall rules. Remove unnecessary or misconfigured rules.
• Enable Network Monitoring and Logging: Monitor network traffic and analyze logs regularly. Use security tools to detect abnormal activities.
• Control Communication Between Subnets: Control communication between subnets with firewall rules. Block unnecessary inter-subnet communication.
• Configure Subnet Masks Correctly: Configure subnet masks correctly. Incorrectly configured subnet masks can lead to network problems and security vulnerabilities.

Real-Life Example: A retail company keeps a database server storing customer data in a separate subnet. Only authorized personnel are allowed access to this subnet. In addition, traffic in this subnet is regularly monitored and logged. In this way, the security of customer data is ensured.

IP Subnet vs. VLAN Comparison

IP subnet and VLAN (Virtual LAN) are two different technologies used to segment network traffic. Both can help improve network security and performance. However, their operating principles and use cases are different.

IP Subnet: IP subnets operate at the network layer (Layer 3) and segment the network using logical IP addressing. A router or Layer 3 switch is required for communication between different subnets. IP subnets offer a more flexible segmentation method, and more detailed security policies can be implemented with firewall rules.

VLAN: VLANs operate at the data link layer (Layer 2) and segment the network using physical ports or MAC addresses. Devices within the same VLAN can communicate directly, while communication between different VLANs requires a router or Layer 3 switch. VLANs provide basic isolation, but a firewall may be needed for more detailed security policies.

When to Use Which?

• IP Subnet: Ideal for segmenting devices with different security requirements in complex networks and applying detailed security policies.
• VLAN: Can be used in simple networks to segment network traffic and reduce broadcast traffic. It can also be used to combine devices in physically different locations on the same network.

IP Subnet Calculation Tools and Usage

IP subnet calculation is a process used to determine which subnet an IP address belongs to, the subnet mask, and the available host addresses. This process can be done manually, or online subnet calculation tools can be used.

Online Subnet Calculation Tools:

• Subnet Calculator: These tools, which can be found on various online platforms, calculate the network address, broadcast address, available host addresses, and other relevant information when you enter an IP address and subnet mask.
• IP Calculator: Used for more comprehensive IP calculation operations, these tools can perform IP address conversion, CIDR calculation, and subnet calculation.

Subnet Calculation Steps (Manual):

1. Convert the IP Address and Subnet Mask to Binary Numbers: For example, convert the 192.168.1.10 IP address and the 255.255.255.0 subnet mask to binary numbers.
2. Subject the IP Address and Subnet Mask to the "AND" Operation: Find the network address by subjecting the binary IP address and subnet mask to the "AND" operation.
3. Calculate the Broadcast Address: Find the broadcast address by subjecting the "0" bits in the subnet mask to the "OR" operation with the corresponding bits in the IP address.
4. Determine Available Host Addresses: The first IP address after the network address and the last IP address before the broadcast address are the available host addresses.

Example: Subnet calculation for the 192.168.1.10/24 IP address:

• IP Address (Binary): 11000000.10101000.00000001.00001010
• Subnet Mask (Binary): 11111111.11111111.11111111.00000000
• Network Address (Binary): 11000000.10101000.00000001.00000000 (192.168.1.0)
• Broadcast Address (Binary): 11000000.10101000.00000001.11111111 (192.168.1.255)
• Available Host Addresses: 192.168.1.1 - 192.168.1.254

Common Mistakes and Solutions Related to IP Subnet

Common mistakes made during IP subnet configuration can lead to network problems and security vulnerabilities. Here are some common mistakes and solutions:

• Incorrect Subnet Mask Usage: Using the wrong subnet mask can cause the network address and broadcast address to be calculated incorrectly. This can lead to devices not being able to communicate with each other or sending traffic to the wrong subnets. Solution: Make sure you are using the correct subnet mask. Choose a subnet mask that suits your network's needs and use the same subnet mask on all devices.
• Conflicting IP Addresses: Assigning the same IP address to more than one device on the same subnet causes an IP address conflict. This can lead to devices not being able to connect to the network or experiencing connection problems. Solution: Use a DHCP server to automatically assign IP addresses. If you are using static IP addresses, make sure you assign a unique IP address to each device.
• Incorrect Default Gateway Configuration: Incorrect default gateway configuration can cause devices to be unable to send traffic to different subnets. Solution: Make sure the default gateway for each device is configured correctly. The default gateway is usually the IP address of the router or Layer 3 switch.
• Incorrect Configuration of Firewall Rules: Incorrect configuration of firewall rules can lead to network traffic being blocked or unauthorized access. Solution: Configure firewall rules carefully and review them regularly. Apply the principle of least privilege and only allow traffic that is necessary.
• DHCP Server Issues: DHCP server issues can lead to IP address assignment problems and network connectivity issues. Solution: Make sure the DHCP server is configured correctly and is running. Check the DHCP server logs regularly and fix any problems.

Case Study: In an office network, some users started to lose internet access after a new printer was added. Upon investigation, it was found that the printer's static IP address conflicted with an existing device. The problem was resolved by changing the printer's IP address.