diff --git a/src/main/scala/com/github/shadowsocks/acl/Subnet.scala b/src/main/scala/com/github/shadowsocks/acl/Subnet.scala
index b41465c0..d7d4cc0b 100644
--- a/src/main/scala/com/github/shadowsocks/acl/Subnet.scala
+++ b/src/main/scala/com/github/shadowsocks/acl/Subnet.scala
@@ -26,7 +26,7 @@ class Subnet(val address: InetAddress, val prefixSize: Int) extends Comparable[S
     var result = addrThis lengthCompare addrThat.length // IPv4 address goes first
     if (result != 0) return result
     for ((x, y) <- addrThis zip addrThat) {
-      result = x compare y
+      result = (x & 0xFF) compare (y & 0xFF)  // undo sign extension of signed byte
       if (result != 0) return result
     }
     prefixSize compare that.prefixSize