What Is CIDR? A Practical Guide to IP Range Calculation

CIDR is a compact way to describe an IP network by writing an address and prefix length together, such as 192.168.1.0/24. The prefix tells you how many bits identify the network; the remaining bits determine the range size and possible host addresses.

What CIDR Actually Tells You

The slash in 192.168.1.0/24 is doing real work. It tells you where the network portion ends and the host portion begins, which is why the same IP address can mean very different things with a different prefix.

CIDR, short for Classless Inter-Domain Routing, writes an address and prefix length together instead of relying on the old fixed Class A, B, and C boundaries. In 192.168.1.0/24, the first 24 bits identify the network. The remaining 8 bits provide 256 IPv4 addresses; in a conventional subnet, 254 are normally assignable to hosts.

RFC 4632 describes CIDR as a way to allocate IPv4 space more precisely and keep routing tables from growing unnecessarily. The prefix is not a host count. That distinction is where many firewall mistakes begin.

A CIDR block gives you four useful pieces of information:

• Network address: The first address in the block.
• Prefix length: The number after the slash, such as /26.
• Total addresses: For IPv4, 2^(32-prefix).
• Conventionally usable addresses: The total after excluding the network and broadcast addresses in an ordinary subnet.

Write the pair together. An IP address without its prefix does not tell you the complete range.

How Many Addresses Fit in a /24, /26, or /30?

An IPv4 address has 32 bits. A longer prefix leaves fewer bits for hosts, so the range gets smaller. The calculation is 2^(32-n), where n is the prefix length.

The word conventionally matters. In an ordinary IPv4 subnet, the first address is the network address and the last is the broadcast address. In 203.0.113.0/24, for example, 203.0.113.0 identifies the network and 203.0.113.255 is the broadcast address. Hosts would normally use 203.0.113.1 through 203.0.113.254.

/31 and /32 need separate treatment. RFC 3021 permits /31 on point-to-point IPv4 links, where both addresses can be assigned to the two interfaces. A /32 represents one IPv4 address and is common for loopbacks, host routes, and narrow firewall matches.

Match the use case. Subtract network and broadcast addresses for an ordinary subnet, but do not apply that rule mechanically to a /31 point-to-point link.

Calculating a CIDR Range by Hand

I still calculate small ranges by hand when I am working over SSH. It is faster than opening a browser, and it gives me a way to sanity-check a tool’s output. Let us use 192.168.10.77/26.

1. Find the mask: /26 corresponds to 255.255.255.192.
2. Calculate the block size: In the final octet, calculate 256 - 192 = 64.
3. List block starts: The possible starts are 0, 64, 128, and 192.
4. Place the IP in a block: 77 falls between 64 and 127, so the network address is 192.168.10.64.
5. Find the broadcast: It is one address before the next block: 192.168.10.127.

The usable host range is 192.168.10.65 through 192.168.10.126. The original .77 address is inside that range, so it is a host address, not the network address.

For 10.20.5.130/27, the mask is 255.255.255.224 and the block size is 32. The relevant blocks are 96-127 and 128-159. The network is 10.20.5.128, the broadcast is 10.20.5.159, and usable hosts run from 10.20.5.129 through 10.20.5.158.

Verify the boundary. Write the network, broadcast, and host range together before creating a firewall or DHCP rule.

CIDR and Dotted Subnet Masks Say the Same Thing

CIDR notation and dotted-decimal subnet masks describe the same network boundary in different forms. 172.16.40.0/20 and 172.16.40.0 combined with 255.255.240.0 identify the same block. CIDR is shorter; the dotted mask can be easier to read on older network equipment.

The examples use documentation space such as 192.0.2.0/24 and private space from 172.16.0.0/12. I prefer that over copying a real customer address into a tutorial.

If a firewall, router, or cloud panel accepts CIDR, you might enter 10.10.0.0/16. An older interface may ask for 255.255.0.0 instead. A typo such as 255.255.255.0 changes the range from 65,536 addresses to 256, so I check the conversion rather than trusting muscle memory.

Checking CIDR on Linux

On Linux, I start with the ip command. It shows what is actually configured, not what I remember configuring earlier in the day.

ip -4 addr show
ip -4 route

The first command lists IPv4 addresses and prefixes on the interfaces. The second displays the kernel’s connected routes and default route. If a VPS provider has supplied a gateway or an additional address block, compare this output with the provider’s network details.

For a direct calculation, use ipcalc if it is installed:

ipcalc 192.168.10.77/26

It normally prints the network, broadcast, host range, wildcard mask, and host count. On Debian and Ubuntu, the package is generally also named ipcalc, although it is not installed by default everywhere. If it is missing, do not invent a firewall rule just because a utility is unavailable. Calculate it by hand or use a calculator you have already checked.

To see which interface and source address the kernel would choose for a destination, run:

ip route get 192.168.10.77

Look at the dev, src, and, where present, via fields. They matter on a VPS with multiple interfaces or policy routes.

I once trusted an address assignment and assumed the route was obvious. It was not. The route lookup showed the kernel’s actual decision, and since then I compare the address, prefix, and route before changing network rules.

Compare the outputs. Check the calculated network against both ip -4 addr and ip -4 route.

IPv6 Uses CIDR Too

IPv6 has 128-bit addresses, but the CIDR idea is unchanged. In 2001:db8:1234:10::/64, the first 64 bits identify the network prefix and the remaining 64 bits are available for interface identifiers. RFC 4291 describes the IPv6 addressing architecture and unicast address structure.

IPv6 has no broadcast address, and it does not use the IPv4 rule that reserves a network and broadcast address in every subnet. An IPv6 /64 therefore contains 2^64 possible addresses mathematically. That does not mean I would put an unlimited number of devices on one LAN; routing, automatic configuration, and security policy still set the practical boundaries.

• /48: Often assigned to an organization or site.
• /56: Can give a customer or home connection multiple subnets.
• /64: Common for one IPv6 link or LAN.
• /128: Represents one IPv6 address, such as a loopback or host route.

When planning IPv6, leave room for route summarization and future subnet growth. Do not carry the IPv4 habit of avoiding the first and last address directly into IPv6.

Plan the prefix. Choose it for routing and future growth, not only for the number of devices you have today.

Using CIDR in Firewalls and Routes

CIDR lets you describe a set of addresses without listing every address separately. For example, 198.51.100.0/24 could represent an office network allowed to reach SSH. That one rule covers 256 IPv4 addresses, so I would verify the whole network before trusting it.

An nftables rule accepting SSH from that IPv4 subnet could look like this:

nft add rule inet filter input ip saddr 198.51.100.0/24 tcp dport 22 accept

This matches IPv4 sources only. IPv6 needs a separate rule using ip6 saddr and an IPv6 prefix. Also remember that a rule entered at the shell is not automatically persistent; persistence depends on how nftables is configured on your distribution.

The same boundary appears in web servers, reverse proxies, and application access lists. An application behind a proxy may see the proxy’s address instead of the client’s. Before enforcing a CIDR restriction, identify which layer makes the decision and accept headers such as X-Forwarded-For only from trusted proxies.

A /32 matches one IPv4 address. A /24 matches 256. Confusing those two in an administration rule can lock out an office, or expose an entire network when you meant to permit one host.

Test narrowly. Keep an existing SSH session open, test from a known source, and prepare the rollback command before applying a remote firewall change.

VLSM: Different Sizes Inside One Network

Variable Length Subnet Masking, or VLSM, means using different subnet sizes inside one larger network. In 192.168.50.0/24, I could allocate a /26 for an office, a /27 for a lab, and a /28 for servers.

Each subnet starts on the correct boundary after the previous one ends. A /27 advances in steps of 32, while a /28 advances in steps of 16. Starting a subnet at an arbitrary address creates collisions between DHCP ranges, static addresses, and routes. Those collisions are tedious to untangle later.

For DHCP planning, see How to Install and Configure DHCP on Windows Server. If you need to identify which device owns an address on a local network, What Is ARP? Address Resolution Protocol Explained covers the underlying address-resolution process.

Leave room. Document gateways, static servers, management interfaces, and future reservations instead of treating every currently unused address as free.

Mistakes I Check Before Applying a CIDR Rule

The first mistake is treating the prefix as a host count. /24 does not mean 24 hosts. It leaves 8 host bits, producing 256 total IPv4 addresses.

Another mistake is assuming that the final octet is automatically the network address. For 192.168.1.77/26, the network is 192.168.1.64; .77 is a host inside that block. The /26 boundaries are 0, 64, 128, and 192.

Cloud networking adds another trap. Some VPS providers assign a public address as /32 and deliver the default gateway through a provider-specific setup. The gateway shown in the panel does not always have to sit inside the apparent interface subnet. Follow the provider’s documentation and inspect the route table.

IPv4 and IPv6 rules are not automatically combined. A rule for 192.0.2.0/24 says nothing about IPv6. On a dual-stack VPS, check nft list ruleset, listening addresses, and access logs for both protocol families.

Finally, keep the scope narrow until the result is proven. Test from a controlled source, keep the current SSH session open, and have a rollback path before making the rule persistent. Network mistakes can lock you out before an application log gives you anything useful.

For the underlying terminology, see What Is an IP Address and How Does It Work? If your question is about traffic capacity rather than address space, VPS Bandwidth Explained: How Much Do You Need? covers a different calculation.

Review the boundary. Before deploying a rule, confirm the prefix, address count, protocol family, and rollback path.

My CIDR Verification Workflow

When I define a new network block, I use this order:

1. Record the complete IP and prefix from the network plan or hosting provider.
2. Convert the prefix into a subnet mask and total address count.
3. Calculate the network and broadcast addresses.
4. Reserve gateways, DNS, DHCP, and static addresses.
5. Check the route table and intended interface.
6. Test the firewall rule with a narrow scope before making it persistent.
7. Keep the plan in IPAM, Git, or another document the on-call person can reach.

A quick command-line check can start here:

ip -4 addr show dev eth0
ip -4 route
ip route get 198.51.100.10

The interface may not be called eth0. Modern systems often use names such as ens3, enp1s0, or a provider-specific virtual interface. Replace it before running the first command.

Apply changes safely. Keep a second SSH session open while changing remote network rules, and have the rollback command ready before you press Enter.

Before Applying a CIDR Change

• Write down the complete IP address and prefix.
• Convert the prefix to a subnet mask.
• Calculate the network and broadcast addresses.
• Count the total and usable addresses.
• Check the route table and intended interface.
• Test the rule from a controlled source.
• Keep a second SSH session and rollback command ready.

Frequently Asked Questions

Sources

• RFC 4632 – Classless Inter-domain Routing — rfc-editor.org
• RFC 3021 – Using 31-Bit Prefixes on IPv4 Point-to-Point Links — rfc-editor.org
• RFC 4291 – IPv6 Addressing Architecture — rfc-editor.org
• RFC 791 – Internet Protocol — rfc-editor.org