An IP address is actually binary when it comes down to it (of course).
The bit mask is used when comparing incoming request source addresses to see if they're permitted. A bitwise and comparison is used.
/n is a shortcut nomenclature to say n out of 32 bits starting at the most significant bit end will be set in the mask.
A class C is the simplest example. A private class C network might be 192.168.1.x with node addresses issued between 1 and 254.
Node addresses 0 and 255 get reserved for other purposes in this instance.
This means that individual nodes will have addresses in this range in binary:
Code: Select all
11000000.10101000.00000001.00000001 to
11000000.10101000.00000001.11111110
(Note that they will all have the first 24 bits in common - ignore the dots when counting).
Suppose you put this in the pg_hba.conf file:
The /32 says ALL 32 bits in the address must match for a source address to be ok. That is to say it must be identical.
In this case ONLY the client machine with the IP address 192.168.1.1 will be allowed to connect (by this rule anyway).
If you wanted any/all machines in the range 192.168.1.1 - 192.168.1.254 to connect you need to match the first 24 bits, because they have these in common, and ignore the last 8 bits.
The mask would need to look like this:
Code: Select all
11111111.11111111.11111111.00000000
This mask has the leftmost 24 bits set to 1, so the entry for this particular network would be:
Your case is a little different because it's class B not C.
Assuming a private class B network 172.16.0.0 with no additional subnetting and you want all nodes to be able to access the server.
Node addresses 172.16.0.1 - 172.16.255.254 will be valid and 172.16.0.0 and 172.16.255.255 will be reserved.
The common part of the addresses will be the first 16 bits and the last 16 should be ignored.
That is to say the mask would need to look like this:
Code: Select all
11111111.11111111.00000000.00000000
The entry for this network would be: