Changing pg_hba.conf network range prevents restart

Question

I have a pgsql9.4 server running on centos with a pg_hba.conf to accept md5 connections from a certain range of IPs. With IPs redacted, my pg_hba.conf file looks like the following:

# TYPE  DATABASE        USER            ADDRESS                 METHOD

# "local" is for Unix domain socket connections only
local   all             all                                     ident
# IPv4 local connections:
host    all             all             127.0.0.1/32            ident
# IPv6 local connections:
host    all             all             ::1/128                 ident
# Allow replication connections from localhost, by a user with the
# replication privilege.
#local   replication     postgres                                peer
#host    replication     postgres        127.0.0.1/32            ident
#host    replication     postgres        ::1/128                 ident
#local  #DBNAME#         #USERNAME#                               md5     
#host   #DBNAME#         #USERNAME#       ###.###.###.0/24          md5

This configuration works great for IPs in the range of xxx.xx.xx.0 through xxx.xx.xx.24. However, when I try to increase it to accommodate access from a server on a higher IP number (112) and try to restart the postgres service, the service fails on restart.

I tried creeping the number up from 0/25 and made it up to a number which runs our puppet server.

I also tried adding a second, identical record to encompass just the IP range 111/112 but to no avail.

Anyone have any ideas as to why Postgres might consider these to be an invalid pg_hba.conf?

EDIT: Forgot to mention that listen_addresses is set to '*' so that access can be controlled user-by-user inside of pg_hba.conf

Answer 1

That host information is the CIDR notation, when you use 172.16.33.0/24 you are not giving the range from 0 to 24, you are, in fact, giving the range from 172.16.33.1 to 172.16.33.254 (read CIDR blocks to understand better why). ipcalc tool can help you identify that:

$ ipcalc 172.16.33.0/24
Network:    172.16.33.0/24
Address space:  Private Use
Address class:  Class B
Netmask:    255.255.255.0 = 24
Broadcast:  172.16.33.255

HostMin:    172.16.33.1
HostMax:    172.16.33.254
Hosts/Net:  254

So, 172.16.33.0/24 already includes 172.16.33.111` and172.16.33.112, meaning you don't need to do anything else inpg_hba.confbut add the line with172.16.33.0/24`.

Answer 2

So it appears as though I was misunderstanding the syntax of the pg_hba.conf file. That 0/24 is not a range of IP addresses.

Examining the postgres logs gave me an error message of invalid CIDR mask in address "###.##.##.111/112" which alerted me to the existence and usage of CIDR notation.

I resolved the error by adding records for each IP that I wanted to accommodate, alongside a /32 to each of them

91 host    DBNAME         USERNAME        172.16.33.111/32        md5
92 host    DBNAME         USERNAME        172.16.33.112/32        md5
93 host    DBNAME         USERNAME        172.16.33.0/24          md5

This seems to work great. Now I just need to brush up my understanding of the different notations used in pg_hba.conf :)