CIDR Subnet Masks: /24, /16 and Calculating Ranges

CIDR (Classless Inter-Domain Routing) is a way of writing an IP address together with its subnet mask: 192.168.1.0/24. The number after the slash is the count of bits reserved for the network.

How CIDR Works

With /24: 24 bits are the network, 8 bits are the hosts. 2^8 = 256 addresses, of which 254 are usable by hosts (the first is the network address, the last is the broadcast address).

192.168.1.0   /24
|------------|------|
 Network(24)  Host(8)

Table of Common CIDR Prefixes

Calculation Formula

# Number of hosts: 2^(32-prefix) - 2
# For /24: 2^(32-24) - 2 = 2^8 - 2 = 254
# For /20: 2^(32-20) - 2 = 2^12 - 2 = 4094

Practical Examples

# UFW — allow an entire subnet
sudo ufw allow from 10.0.0.0/8

# iptables — block a range
iptables -A INPUT -s 192.168.100.0/24 -j DROP

# Nginx — restrict access by IP
location /admin {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}

CIDR in WireGuard and OpenVPN

# WireGuard — AllowedIPs = routed ranges
[Peer]
AllowedIPs = 10.0.0.0/8, 172.16.0.0/12

# All traffic through the VPN
AllowedIPs = 0.0.0.0/0, ::/0

Common CIDR calculation mistakes

The error "network address not aligned" when configuring a route or VLAN means the given network address is not a multiple of the block size. For /26 (a 64-address block) the network must start at 0, 64, 128, or 192 in the last octet, not at an arbitrary number.

# Wrong: 192.168.1.100/26 - not the start of a block
# Right: 192.168.1.128/26 - start of a block (128, 128+64=192)

ip addr add 192.168.1.100/26 dev eth0
RTNETLINK answers: File exists

The error RTNETLINK answers: File exists in this context usually means a conflict with an already existing network route rather than a CIDR problem itself — but the root cause is often exactly a wrongly calculated subnet boundary.

UFW rejects the rule with "ERROR: Bad source address" — the typical cause is a CIDR mask given without a network address (for example /24 with no IP), or a decimal mask used instead of a prefix.

sudo ufw allow from 10.0.0.0/255.0.0.0 to any port 22
ERROR: Bad source address

UFW accepts only prefix notation: the correct form is 10.0.0.0/8, not a decimal mask after a slash.

CIDR versus classful addressing

When manual CIDR math is not needed

• A one-off setup on a single server — it is simpler to enter the IP into an online calculator than to keep powers of two in your head.
• Automation through Terraform, Ansible, or a cloud panel — these tools already check subnet overlaps and mask validity.
• The network is already designed by the provider (for example a VPC on a cloud host) — changing it manually is usually neither possible nor needed.
• You need to quickly check whether two subnets overlap — a calculator shows the ranges visually, while comparing bit masks by hand easily leads to a mental mistake.
• VLSM (variable-length subnet masking) is planned for several departments at once — picking boundaries by hand with no tool almost guarantees overlaps between blocks.

Verifying the result

1. Calculate the range for your subnet and cross-check it with a calculator (cidr.xyz or ipcalc): the network address, broadcast address, and host count must match.
2. Apply the mask on the interface: ip addr add 192.168.1.128/26 dev eth0 — the command must not return an error.
3. Check the actual mask: ip addr show eth0 — the output must show the same prefix.
4. For firewall rules, verify the target host falls inside the range: ipcalc 192.168.1.130/26 shows the network boundaries and confirms the address is inside the block.

CIDR math is directly tied to IPv4 addressing — see the article on IPv4 address structure for more, and for configuring the routes themselves see the article on ip route and Netplan.

Frequently asked questions

Does a smaller number after the slash in CIDR notation mean a bigger network or a smaller one?

The smaller the number after the slash, the bigger the network and the more addresses it contains, since that number represents the bits reserved for the network portion rather than for hosts. The remaining bits go to hosts, and the more of them there are, the roomier the address range inside the subnet — the relationship runs opposite, not direct.

What happens when two subnets with overlapping ranges end up in the same routing table?

Overlapping subnet ranges in one routing table create ambiguity — the system either refuses the conflicting route with an error, or applies whichever has the more specific prefix, ignoring the broader range for the overlap. The outcome depends on the network stack and route order, so overlaps are best ruled out with a calculation beforehand, not discovered later.

Does CIDR notation only apply to IPv4, or does IPv6 use it too?

The underlying idea of writing an address with a prefix length after a slash is shared by both protocols, but IPv6 uses its own, much longer addressing scheme and its own typical block sizes that do not carry over directly from IPv4 tables and examples. The IPv4 host-count formula does not apply to IPv6, because the address length differs.

Can any CIDR block be picked for a private network, or are some address ranges reserved?

No, part of the address space is reserved by separate standards for specific purposes such as private networks, the loopback interface, or multicast, and using those ranges for anything else is unwise even when nothing stops you from configuring them. For a private network, pick a block from ranges set aside for internal use rather than an arbitrary public address.