Subnet math and CIDR explained

Published: 2026-07-20

How network addresses, prefix lengths, and netmasks relate — IPv4 CIDR basics for firewall rules and cloud VPC design.

CIDR (Classless Inter-Domain Routing) writes IPv4 networks as address/prefix, e.g. 192.168.1.0/24. The prefix length (24) counts leading 1 bits in the subnet mask; the remainder identifies hosts in that subnet. Firewall rules, Docker networks, and cloud VPCs all speak this language.

Prefix length and mask

CIDR Mask Host bits Usable hosts (typical IPv4)
/32 255.255.255.255 0 1 (single host)
/24 255.255.255.0 8 254 (.1–.254, excluding network/broadcast)
/16 255.255.0.0 16 65,534
/8 255.0.0.0 24 ~16M

Network address has host bits all zero; broadcast has host bits all one (IPv4). Some modern networks treat /31 specially for point-to-point links (RFC 3021).

Worked example: 10.0.5.0/24

  • Network: 10.0.5.0
  • Mask: 255.255.255.0
  • Broadcast (IPv4): 10.0.5.255
  • First host: often 10.0.5.1 (gateway)
  • Last host: often 10.0.5.254

Private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — common in home and lab networks.

Wildcard masks (ACLs)

Cisco-style wildcard masks invert the subnet mask logic for access lists: 0.0.0.255 means “match any value in the last octet.” Subnet calculators often show wildcard alongside CIDR for firewall copy-paste.

IPv6 note

IPv6 uses the same /prefix notation with 128-bit addresses. /64 is typical for subnets; address space is vast so “usable host count” is less conversational than in IPv4.

Try it locally

The Subnet Calculator computes network, broadcast (IPv4), usable range, wildcard mask, binary view, and classification — entirely in your browser.

For bulk CIDR checks against allowlists, watch for future LocalTools network utilities; today you can combine calculator results with Diff Checker for rule reviews.

Related reading

← All learn articles