Addressing and Routing
Read IP prefixes, cloud subnets, gateways, and the routes a Linux host will use.
An address identifies an interface. A prefix defines the network around it. A route selects the next hop and interface for a destination.
Read a prefix
For 10.20.4.17/24, the first 24 bits describe the network and the remaining 8 bits identify addresses inside it. The network prefix is 10.20.4.0/24.
| Prefix | Total IPv4 addresses | Common use |
|---|---|---|
/32 | 1 | One host or route target |
/28 | 16 | Small subnet |
/24 | 256 | Conventional application subnet |
/16 | 65,536 | Larger private network boundary |
Cloud providers reserve addresses inside a subnet for platform functions. Do not calculate usable capacity from the total alone; check the provider’s subnet rules.
Inspect interfaces and routes
A typical IPv4 route table might contain:
The connected route reaches the local subnet directly. The default route sends destinations without a more-specific match to the gateway. Linux selects the most specific matching prefix; route metric helps choose between otherwise comparable routes.
Ask the kernel how it would route one destination without sending a packet:
Check the selected interface, gateway, and source address. If the source is wrong on a multi-homed host, inspect policy rules with ip rule as well as the main route table.
Map the cloud path
A common layout separates public entry points from private workloads:
For every subnet, document:
- its IPv4 and IPv6 prefixes;
- the route table attached to it;
- the path for internet, private network, and service endpoints;
- inbound and outbound firewall policy; and
- whether addresses are stable or allocated dynamically.
Route tables provide reachability; they do not grant permission. A valid route can still be blocked by a security group, network ACL, host firewall, or service binding.
IPv6 changes the assumptions
An IPv6 address can be globally routable without IPv4-style NAT. That does not mean it is publicly allowed: enforce explicit inbound and outbound policy and confirm the service binds to IPv6.
Test IPv4 and IPv6 independently. A published AAAA record with a broken IPv6 path can produce intermittent-looking failures because clients may choose different address families.
Do not change a remote default route casually
Replacing an interface address or default route can end the SSH session immediately. Use a disposable lab first. On a remote server, keep provider-console access open and arrange an automatic rollback before applying the change.