The secondary element can also specify an exception for a range of IP addresses that are contained within the larger range defined by the primary element.
- Instead of a single IP address exception, you can deny access to IP addresses for several computers in the company, for example, work stations 22.214.171.124 through 126.96.36.199, with the following deny element:
The deny element is equivalent to the following binary number:
The 255 in the final segment of the deny IP is optional. You can use any number between 192 and 255 to give the same results, based on the mask construction shown in the following bullet.
- The following mask forces the filter to deny access to all workstations with IP addresses from 188.8.131.52 through 184.108.40.206:
This mask format indicates that only the last two bits of the fourth segment are significant. If you AND the binary values for the deny IP and the mask, the result shows why you can specify such a wide range of addresses in the forth segment of the deny IP.
Deny IP 10001101.11001110.00100011.11111111 Mask 11111111.11111111.11111111.11000000 ____________________________________________ Result 10001101.11001110.00100011.11000000
The mask is equivalent to /26”>, and indicates that the first 26 bits (the bold characters in the result) of the incoming IP address must match the masked deny IP to access to deny the incoming IP address. All IP addresses from 220.127.116.11 through 18.104.22.168 match the bold characters. IP addresses from 22.214.171.124 through 126.96.36.199 have a value of zero for either bit 25 or 26 (or both), do not match all 26 significant binary values, and therefore are not denied.
The restriction process applies the range of the secondary element, whether it is an allow or a deny, to the binary string from left to right, that is, high to low address. The further to the left you extend the zeros in the mask, the more restrictive the secondary deny. For example, a partial mask of the third segment significantly increases the range addresses affected.