0

I am trying to create a firewall rule to allow Microsoft Teams thru my firewall. I can see here https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#skype-for-business-online-and-microsoft-teams

that 52.112.0.0/14 is the address used but the ip that is recorded in my router is 52.113.89.125.

The 89.125 can change from time to time but when I looked it up on https://ipinfo.io/52.113.89.125 its 'route' is 52.112.0.0/14...

I would like to be able to create a fire wall rule for this but I am unsure of what 52.112.0.0/14 means and how to construct the firewall rule

Improve this question
1
  • This is not really about firewalls or security. This is really just about IP addressing. as the answer below shows. This would have been better asked on a networking site.
    – schroeder
    Nov 26, 2020 at 7:51

1 Answer 1

Reset to default
3

The 52.112.0.0/14 is Classless Inter-domain Routing CIDR notation (RFC 4632).

The IP Calculator by Krischan Jodies illustrates this nicely:

Address:   52.112.0.0            00110100.01110000.00000000.00000000
Netmask:   255.252.0.0 = 14      11111111.11111100.00000000.00000000
Wildcard:  0.3.255.255           00000000.00000011.11111111.11111111
=>
Network:   52.112.0.0/14         00110100.01110000.00000000.00000000
Broadcast: 52.115.255.255        00110100.01110011.11111111.11111111
HostMin:   52.112.0.1            00110100.01110000.00000000.00000001
HostMax:   52.115.255.254        00110100.01110011.11111111.11111110
Hosts/Net: 262142

As 52.112.0.0/14 has host range 52.112.0.1-52.115.255.254, the 52.113.89.125 belongs to it.

But just allowing 52.112.0.0/14 is not enough, as the site lists several ranges for the service. You would have to add them all in your rules to make it work reliably.

A firewall could be many things: it is impossible to tell how to construct rules for your firewall.

Improve this answer
4
  • thanks..my router allows for Range Address and if 52.112.0.0/14 covers 52.112.0.1 to 52.115.255.254 could I not just use that range as from start to end ip?
    – kurasa
    Nov 26, 2020 at 7:08
  • 3
    You could, but CIDR notation is a more compact and easier to remember form. If you work with networks, it's worth learning. It's widely used.
    – vidarlo
    Nov 26, 2020 at 7:11
  • 1
    CIDR is much more efficient when matching address prefixes. With software-based routers/firewalls it uses less CPU cycles, and with hardware-based devices it uses just a single TCAM entry.
    – Zac67 ♦
    Nov 26, 2020 at 10:43
  • 1
    @Zac67: Exactly, and sometimes a range is internally converted to CIDR notation anyway. Therefore, by specifying just the host address range 52.112.0.1-52.115.255.254 instead of the whole 52.112.0.0/14 i.e. 52.112.0.0-52.115.255.255 you may actually end up adding 52.112.0.1/32, 52.112.0.2/31, ..., 52.113.0.0/16, 52.114.0.0/16, ..., 52.115.255.252/31 & 52.115.255.254/32. Which is 34 separate CIDR ranges instead of the one.
    – Esa Jokinen
    Nov 26, 2020 at 11:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.