Subnetting made simple: CIDR, netmasks, and host counts

Subnetting sounds like something only network engineers need, but the moment you set a firewall rule, configure a private network, or read "allow 10.0.0.0/8," you're using it. The concepts are simpler than the reputation suggests. Here's subnetting explained without the exam-cram pain.

An IP address is two parts

An IPv4 address like 192.168.1.10 is 32 bits, written as four 8-bit octets (0–255 each). A subnet splits those 32 bits into two sections:

• A network portion — identifies the network everyone on it shares.
• A host portion — identifies the individual device within that network.

The subnet mask is what draws the line between them. Everything to the left of the line is network; everything to the right is host.

CIDR notation: the /number

CIDR (Classless Inter-Domain Routing) writes the mask as a slash and a count of network bits:

• /24 means the first 24 bits are network, leaving 8 bits for hosts.
• /16 means 16 network bits, 16 host bits.
• /8 means 8 network bits, 24 host bits.

So 192.168.1.0/24 is a network where the first three octets are fixed and the last octet varies per host. That's the most common home/office network you'll see.

CIDR to netmask, at a glance

The mask is just those network bits set to 1, written in dotted-decimal:

| CIDR | Netmask | Host bits | Total addresses | Usable hosts | |---|---|---|---|---| | /24 | 255.255.255.0 | 8 | 256 | 254 | | /25 | 255.255.255.128 | 7 | 128 | 126 | | /26 | 255.255.255.192 | 6 | 64 | 62 | | /27 | 255.255.255.224 | 5 | 32 | 30 | | /28 | 255.255.255.240 | 4 | 16 | 14 | | /30 | 255.255.255.252 | 2 | 4 | 2 |

Counting hosts: the one formula

Number of addresses in a subnet is 2 to the power of the host bits. For a /24, that's 2^8 = 256 addresses.

But you don't get all of them for devices. Every subnet reserves two:

• The network address — the first address (all host bits 0), which names the subnet itself.
• The broadcast address — the last address (all host bits 1), used to reach every host at once.

So usable hosts = 2^(host bits) − 2. A /24 gives 256 − 2 = 254 usable addresses. A /30 gives 4 − 2 = 2 — exactly right for a point-to-point link between two routers, which is why /30s are everywhere in WAN setups.

Network, broadcast, and range in practice

For 192.168.1.0/24:

• Network address: 192.168.1.0
• First usable host: 192.168.1.1 (typically the gateway)
• Last usable host: 192.168.1.254
• Broadcast address: 192.168.1.255

Splitting a network (subnetting proper)

Say you have 192.168.1.0/24 and want two separate networks. Borrow one host bit for the network side, turning /24 into two /25s:

• 192.168.1.0/25 — hosts .1 to .126, broadcast .127
• 192.168.1.128/25 — hosts .129 to .254, broadcast .255

Each half now has 126 usable hosts and can be routed or firewalled independently. Borrow more bits to make smaller, more numerous subnets — the classic trade-off between how many subnets you have and how many hosts fit in each.

Private ranges worth memorising

These blocks are reserved for private networks and never routed on the public internet:

• 10.0.0.0/8 — 16 million addresses; big cloud/private networks.
• 172.16.0.0/12 — mid-size ranges.
• 192.168.0.0/16 — home and small-office networks.

When you build a private network between VPS instances or set a firewall rule, you'll draw from these.

Where this shows up day to day

• Firewall rules: "allow 203.0.113.0/24" permits a whole /24 block in one line.
• Cloud private networking: you assign a CIDR to a virtual network and carve subnets from it.
• VPNs: WireGuard and OpenVPN configs are full of CIDR ranges deciding what traffic is routed.
• Access control: allowlisting an office's IP range is a CIDR entry.

Skip the mental math

Our free subnet calculator at /tools/subnet-calculator takes any IP and CIDR (or netmask) and instantly returns the network address, broadcast address, usable host range, host count and the mask in every format. Use it to plan a network, sanity-check a firewall rule, or just confirm a /26 has the room you think it does.

Building something that needs real private networking and firewall control? A Nxeon VPS gives you a dedicated IP and full root over your firewall and routes, so these CIDR ranges are yours to command. See /vps.