IP Address, Mask, and Gateway: Reading the Network Map

How do you read an address like 192.168.10.20, and know which machines it can talk to directly? That question gets settled before touching any firewall configuration.

An IPv4 address is written as four numbers separated by dots. On its own, it does not say which machines can talk to each other directly: you also need the subnet mask, which splits the address into two parts, a network part and a host part.

The /24 notation is shorthand for the mask 255.255.255.0: it means the first 24 bits of the address (the first three numbers) name the network, and the remaining 8 bits name one host among 254 possible ones inside that network. Two machines that share the same first three numbers and the same /24 mask can talk to each other directly, with no intermediary. Two machines on different networks need a router, or here an OPNsense firewall, to bridge between them.

The Gateway, the Network's Exit Door

When a machine needs to reach an address outside its own network, it sends the packet to its gateway: the address of an interface on the router or firewall that knows the rest of the path. Without a configured gateway, a machine can still talk to its own local network, but literally does not know where to send anything else.

This course simulates a public network, the equivalent of the Internet, on the block 203.0.113.0/24. This exact range is reserved by RFC 5737 for documentation and exercises: it belongs to no one on the real Internet and is never routed there. Here it plays the role of the WAN, while 192.168.10.0/24 plays the internal network (LAN) and 192.168.20.0/24 an exposed zone, the DMZ. One technical detail follows directly from this: an option called Block private networks, which would normally block private addresses like 192.168.x.x, must stay unchecked on the lab's WAN interface. Checked, it would also block attempts from the attacker machine, whose address 203.0.113.10 looks like a private address to this filter even though it simulates a public one here.

There are two ways to assign an address: DHCP, which hands it out automatically and can change it between reboots, and static addressing, entered once and for all. A server you need to reach reliably, like the DMZ web server, should always be set up with a static address: an address that changes on every reboot would break any firewall rule or redirect written to target it.

What to remember

• An IP address alone is not enough: the mask (here /24) tells you which part names the network and which part names the host.
• Two machines that do not share the same network need a router or firewall, through the gateway, to talk to each other.
• 203.0.113.0/24 simulates the Internet in this course (reserved by RFC 5737, never routed on the real Internet); 192.168.10.0/24 is the LAN, 192.168.20.0/24 the DMZ.
• A server you need to reach reliably should be set up with a static address, never DHCP.

Common trap: a question gives two addresses that start the same way (say, both with 192.168) and asks whether they sit on the same network. The only way to answer correctly is to compare the bits covered by the mask, not just the first digits visible to the eye.

*Checked on September 27, 2026 against the OPNsense documentation (Interfaces, Block private networks option) and RFC 5737.*