Essential Network Basics for Ops: IP, Subnet Mask, and Gateway Explained in One Go

IP Address Basics

IPv4 is a 32‑bit binary number usually written as four decimal octets. Example: 192.168.1.1 → 11000000.10101000.00000001.00000001. Powers of two (128, 64, 32, 16, 8, 4, 2, 1) are useful for conversion.

192 = 128+64 = 11000000
168 = 128+32+8 = 10101000
1   = 00000001

Historical classful ranges (A‑E) are largely obsolete; operations typically use private RFC 1918 ranges:

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

Special Addresses

# Loopback
127.0.0.1   # IPv4 localhost
::1         # IPv6 localhost

# Broadcast (rare)
192.168.1.255   # broadcast for 192.168.1.0/24

# Network address
192.168.1.0    # represents the whole subnet

# Link‑local (auto‑config)
169.254.0.0/16  # Windows DHCP fallback
fe80::/10      # IPv6 link‑local

# Zero address
0.0.0.0/0      # "any" address used in routing tables

Viewing Local Network Information

# Show all IP configs (recommended)
ip addr show
ip addr show eth0

# Show routing table
ip route show
ip route

# Show ARP table (IP‑MAC mapping)
ip neigh show
arp -a

# Show listening ports
ss -tlnp
netstat -tlnp

# Show current connections
ss -tnp
netstat -tnp

# Show interface statistics
ip -s link show eth0

Subnet Mask and CIDR

Subnet Mask

A subnet mask marks network bits (1) and host bits (0) in a 32‑bit address.

Subnet mask example: 255.255.255.0
Binary: 11111111.11111111.11111111.00000000

IP 192.168.1.100 & mask 255.255.255.0:
Network part = 192.168.1
Host part    = 100
Network address = 192.168.1.0
Broadcast address = 192.168.1.255

Notation

Dot‑decimal: 255.255.255.0 CIDR: /24 (first 24 bits are network)

Common CIDR Quick‑Calc

/32  = 255.255.255.255  hosts:1
/31  = 255.255.255.254  hosts:2 (point‑to‑point)
/30  = 255.255.255.252  hosts:4
/29  = 255.255.255.248  hosts:8
/28  = 255.255.255.240  hosts:16
/27  = 255.255.255.224  hosts:32
/26  = 255.255.255.192  hosts:64
/25  = 255.255.255.128  hosts:128
/24  = 255.255.255.0    hosts:256 (usable 254)
/23  = 255.255.254.0    hosts:512
/22  = 255.255.252.0    hosts:1024
/21  = 255.255.248.0    hosts:2048
/20  = 255.255.240.0    hosts:4096
/16  = 255.255.0.0      hosts:65536
/8   = 255.0.0.0        hosts:16777216

Usable hosts = 2^(32‑CIDR) ‑ 2 (network and broadcast excluded).

Choosing CIDR Size

/30 or /31 : point‑to‑point links
/29          : small service clusters
/28          : departmental server clusters
/27          : medium‑scale business line
/26          : larger business line
/25 or /24   : large scale – whole Kubernetes cluster or VPC subnet
/16 or /8    : data‑center‑wide segmentation

Subnet Division Example

Given 192.168.0.0/24 and four departments each needing ~50 hosts, allocate /26 (64 addresses) per department:

Department A: 192.168.0.0/26   (Network 192.168.0.0, Hosts 1‑62, Broadcast 63)
Department B: 192.168.0.64/26  (Network 192.168.0.64, Hosts 65‑126, Broadcast 127)
Department C: 192.168.0.128/26 (Network 192.168.0.128, Hosts 129‑190, Broadcast 191)
Department D: 192.168.0.192/26 (Network 192.168.0.192, Hosts 193‑254, Broadcast 255)

Validate on Linux with ipcalc:

# Debian/Ubuntu
apt install ipcalc
# CentOS/RHEL
yum install ipcalc
ipcalc 192.168.0.0/26
ipcalc 192.168.0.64/26
ipcalc 192.168.0.128/26
ipcalc 192.168.0.192/26

Default Gateway

Gateway Role

Devices in the same subnet communicate directly; traffic crossing subnets is forwarded to a gateway (usually the router’s interface IP).

Scenario: 192.168.1.10 wants to reach 192.168.2.20
1. Host sees destination outside its /24 subnet.
2. Host sends packet to default gateway (e.g., 192.168.1.1).
3. Gateway routes the packet toward the target network.
4. Destination receives the packet.

Viewing and Configuring Gateway

# Show routing table (includes default gateway)
ip route show
# Example line:
# default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.100 metric 600

# Add temporary default gateway
ip route add default via 192.168.1.1 dev eth0
# Delete it
ip route del default via 192.168.1.1

Cloud VPC Gateways

In Alibaba Cloud, AWS, or Tencent Cloud VPCs the gateway IP is automatically the first address of the subnet (e.g., 192.168.1.1). Security groups control inbound/outbound traffic for cloud servers.

VLAN (Virtual LAN)

Purpose

VLANs partition a physical switch into multiple broadcast domains. Devices in different VLANs on the same switch cannot communicate without a Layer‑3 router.

# Example network segmentation
- Management VLAN 100: 192.168.1.0/24
- Business VLAN 200:   192.168.2.0/24
- Storage VLAN 300:   192.168.3.0/24

# Within a VLAN, servers talk directly; across VLANs they need routing.

Linux VLAN Configuration

# Load 8021q module
modprobe 8021q

# Create VLAN interface eth0.100 (id 100)
ip link add link eth0 name eth0.100 type vlan id 100

# Assign IP
ip addr add 192.168.1.10/24 dev eth0.100

# Bring up interface
ip link set eth0.100 up

# Verify
ip link show type vlan
cat /proc/net/vlan/config

# Delete VLAN
ip link del eth0.100

Switch Port Modes

Access : connects end devices, belongs to a single VLAN, frames are untagged.

Trunk : connects switches/routers, carries multiple VLANs, frames are tagged.

Hybrid (Huawei): flexible tagging per port.

Routing Basics

How Routing Tables Work

Every IP device (host, router, Layer‑3 switch) maintains a routing table. When sending a packet, the device selects the most specific entry (longest prefix match).

# Example routes for destination 10.20.30.40
0.0.0.0/0          -> default
10.0.0.0/8          -> match 8 bits
10.20.0.0/16        -> match 16 bits
10.20.30.0/24       -> match 24 bits   <-- chosen

Adding and Deleting Routes

# Temporary static route (lost after reboot)
ip route add 10.10.0.0/16 via 192.168.1.1 dev eth0
ip route add 10.10.10.20/32 via 192.168.1.1 dev eth0
# Blackhole route (drop traffic)
ip route add blackhole 10.10.10.0/24
# Delete route
ip route del 10.10.0.0/16 via 192.168.1.1 dev eth0

# Persist on CentOS 7/8
echo "10.10.0.0/16 via 192.168.1.1 dev eth0" >> /etc/sysconfig/network-scripts/route-eth0
# Persist on Debian/Ubuntu
echo "up ip route add 10.10.0.0/16 via 192.168.1.1 dev eth0" >> /etc/network/interfaces

Policy Routing (Advanced)

# View existing rules
ip rule show
# Add rule based on source subnet
ip rule add from 192.168.1.0/24 table 100
ip route add default via 192.168.1.1 dev eth0 table 100
# Add rule based on fwmark (used for traffic shaping)
iptables -A PREROUTING -s 10.0.0.0/8 -j MARK --set-mark 1
ip rule add fwmark 1 table 200
ip route add default via 10.0.0.1 dev eth1 table 200

DNS Basics

Purpose

DNS translates human‑readable domain names to IP addresses. A common symptom is “ping works to IP but not to hostname”, indicating DNS failure.

# View configured DNS servers
cat /etc/resolv.conf
# Test resolution
nslookup www.baidu.com
dig www.baidu.com
host www.baidu.com
# Flush/restart cache (systemd‑resolved)
systemctl restart systemd-resolved
# Query a specific DNS server (Google)
nslookup www.baidu.com 8.8.8.8
dig @8.8.8.8 www.baidu.com

/etc/hosts Local Resolution

# Format: IP  hostname  alias
127.0.0.1   localhost localhost.localdomain
192.168.1.100 db-master.internal db-master
192.168.1.101 db-slave.internal db-slave
10.244.1.5   redis-01.default.svc.cluster.local redis-01
# /etc/hosts overrides DNS (order can be changed in /etc/nsswitch.conf)

Network Troubleshooting Process

Layered Diagnosis

Layer 1: Physical – check cables, link lights
Layer 2: Data link – MAC, ARP, switch ports
Layer 3: Network – IP, subnet mask, routing, gateway
Layer 4: Transport – TCP/UDP ports, firewall state
Layer 5: Application – HTTP response, DNS, certificates

Common Commands

ip addr show eth0

– verify IP and mask ping -c 3 192.168.1.1 – test gateway reachability ping -c 3 8.8.8.8 – test external connectivity nc -zv 192.168.1.100 22 – test TCP port ip route show – inspect routing table traceroute 8.8.8.8 – trace path nslookup www.example.com – DNS lookup iptables -L INPUT -n -v – firewall rules ss -tlnp – listening sockets ip neigh show – ARP table

Typical Failure Cases

Case 1: Machine gets 169.254.x.x (link‑local)

# Cause: DHCP failed, OS assigned link‑local address.
# Steps:
ip link show eth0               # verify interface state
cat /etc/network/interfaces    # or ifcfg‑eth0, check DHCP config
dhclient -r eth0 && dhclient eth0   # retry DHCP
# If static, assign correct IP manually:
ip addr add 192.168.1.100/24 dev eth0
ip route add default via 192.168.1.1

Case 2: Same‑subnet machines cannot ping

# Verify IP/mask on both hosts.
# Ensure they belong to the same /24 network.
# Check ARP entries:
arp -a | grep 192.168.1.20
# Inspect firewall for ICMP DROP.
iptables -L INPUT -n | grep icmp
# Confirm interface is UP:
ip link show eth0

Case 3: Cross‑subnet ping fails

# Verify default gateway is set and reachable.
ping -c 1 192.168.1.1
# Check gateway routing for the target subnet.
# Ensure return path exists on the remote side.
# Common reasons: missing gateway entry, ACL blocking ICMP.

Case 4: DNS resolves but connection fails

# Test TCP/UDP reachability:
nc -zv www.baidu.com 443   # HTTPS
nc -zuv 8.8.8.8 53          # DNS UDP
# Examine routing and traceroute.
ip route show
traceroute www.baidu.com
# Check outbound firewall rules.
iptables -L OUTPUT -n -v
# Verify MTU (VPN often causes fragmentation):
ip link show eth0
ping -c 3 -M do -s 1400 8.8.8.8
# Check proxy environment variables.
echo $http_proxy
env | grep -i proxy

Docker / Kubernetes Networking

Docker Network Modes

# List networks
docker network ls
# Common modes:
# bridge – default, containers get 172.17.0.0/16 addresses
# host   – container shares host network stack
# overlay – multi‑host (Swarm)
# macvlan – containers obtain real MAC addresses
# Inspect container IP:
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' container_name
# Test inter‑container ping:
docker exec -it container_a ping -c 1 container_b

Kubernetes Network Model

All Pods must be able to reach each other directly (no NAT). Nodes must reach all Pods. The Pod IP seen by any other Pod is the same.

CNI Plugin Comparison

Flannel – simple, VXLAN encapsulation

Calico – BGP support, high performance

Cilium – eBPF acceleration, strong observability

Weave – simple, encrypted traffic

# View node IPs and Pod CIDRs
kubectl get nodes -o wide
kubectl get pods -o wide --all-namespaces
# View Service ClusterIP
kubectl get svc -o wide
# Diagnose Pod network
kubectl exec -it pod_name -- ip addr
kubectl exec -it pod_name -- cat /etc/resolv.conf
kubectl exec -it pod_name -- ping -c 1 8.8.8.8
# Check CNI logs (Calico example)
kubectl logs -n kube-system -l k8s-app=calico-node
journalctl -u kubelet | grep -i cni

Firewall Basics

iptables

# List all rules
iptables -L -n -v
# Tables: raw, mangle, nat, filter (default)
# Chains: PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING
# Allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Allow HTTP/HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# Accept established/related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Drop everything else
iptables -A INPUT -j DROP
# Save rules (CentOS)
service iptables save
# Save rules (Debian/Ubuntu)
iptables-save > /etc/iptables/rules.v4
# Restore
iptables-restore < /etc/iptables/rules.v4

nftables (new generation)

# Show current ruleset
nft list ruleset
# Create table and chain
nft add table ip filter
nft add chain ip filter input { type filter hook input priority 0 \; }
# Allow SSH
nft add rule ip filter input tcp dport 22 accept
# Accept established connections
nft add rule ip filter input ct state established,related accept
# Drop everything else
nft add rule ip filter input counter drop
# Persist configuration
nft list ruleset > /etc/sysconfig/nftables.conf

Production‑Grade Network Security Recommendations

Principle of Least Privilege

# Restrict SSH source range
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
# Disable ICMP broadcast (amplification attack)
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Disable source routing
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
# Enable reverse‑path filtering (anti‑spoof)
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
# Disable ICMP redirects
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects

Internal Network Isolation

# Separate business segments with VLANs or cloud security groups.
# Example: allow MySQL only from app subnet
iptables -A INPUT -p tcp --dport 3306 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
# Redis – bind to internal subnet and rename dangerous commands
bind 10.0.1.0/24
rename-command FLUSHALL ""
rename-command FLUSHDB ""
rename-command SHUTDOWN ""
# Periodically audit connections
ss -tnp | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

Permanent Network Tuning (sysctl)

# /etc/sysctl.d/99-custom.conf
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_rmem = 4096 87380 6291456
net.ipv4.tcp_wmem = 4096 65536 6291456
net.ipv4.tcp_window_scaling = 1
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_tcp_timeout_established = 432000
# Apply
sysctl -p

Conclusion

Mastering IP addressing, subnet masks, CIDR, gateway behavior, VLAN segmentation, routing principles, DNS resolution, container networking, firewall configuration, and systematic troubleshooting enables engineers to diagnose and resolve most connectivity problems within minutes.