Subnet Mask and CIDR Calculator

Every address plan starts with the same arithmetic: how many hosts fit in a /26, where does the next network start, what is the mask in dotted form. The numbers are easy to get wrong by one, and a wrong one means two networks that overlap or a range that wastes half its space.

Reading a CIDR prefix

A prefix length is the number of leading bits that identify the network. A /24 leaves 8 host bits, so 256 addresses; the first is the network address and the last the broadcast, which leaves 254 for hosts. Two exceptions matter: a /31 has no broadcast and both addresses are usable on a point-to-point link (RFC 3021), and a /32 is a single host.

192.168.1.0/24
  netmask   255.255.255.0
  wildcard  0.0.0.255
  broadcast 192.168.1.255
  hosts     192.168.1.1 - 192.168.1.254 (254)

Splitting into equal subnets

Each extra bit in the prefix halves the network. A /24 split into four becomes four /26 networks of 62 hosts each, starting at .0, .64, .128 and .192. Always start the next subnet on a multiple of its own size, otherwise the networks overlap.

192.168.1.0/26    192.168.1.64/26
192.168.1.128/26  192.168.1.192/26

Planning with VLSM

When segments differ in size, give each the smallest block that fits and allocate the largest first, so every block stays aligned and the free space stays in one piece at the end. 100 hosts needs a /25, 50 a /26, 20 a /27 and a router link a /30.

office 100 -> 10.10.0.0/25
guests  50 -> 10.10.0.128/26
servers 20 -> 10.10.0.192/27

IPv6 is simpler, with one rule

IPv6 has no broadcast and so many addresses that you do not count hosts. Give every subnet a /64: SLAAC and several other features assume it. A site normally receives a /48 or /56, which splits into 65,536 or 256 subnets.

2001:db8:1234::/48 -> 2001:db8:1234:0::/64 ... 2001:db8:1234:ffff::/64

Open the Subnet calculator generator

Frequently asked questions

What is the difference between a netmask and a wildcard mask?

A netmask has ones for the network part (255.255.255.0). A wildcard mask is its inverse (0.0.0.255) and is what some router access lists use to say which bits may vary.

Why does a /24 have 254 hosts and not 256?

The first address names the network and the last is the broadcast address, so neither can be given to a host. A /31 and a /32 are the exceptions.

Can I type a netmask instead of a prefix?

Yes: 192.168.1.0 255.255.255.0 is read as /24. A mask that is not contiguous, such as 255.0.255.0, is refused.

Guides

• Nginx Reverse Proxy Configuration
• Caddy Reverse Proxy Configuration
• Nginx Static Site Configuration
• Caddy Static Site Configuration
• Nginx + PHP-FPM Configuration
• Caddy + PHP-FPM Configuration
• Nginx SSL/TLS Configuration
• Nginx Load Balancer Configuration
• Caddy Load Balancer Configuration
• Nginx Rate Limiting Configuration
• Nginx Security Headers Configuration
• Caddy Security Headers Configuration
• Nginx Gzip Compression Configuration
• Nginx Caching Configuration
• Caddy HTTPS Redirect Configuration
• Nginx WebSocket Proxy Configuration
• Nginx Content-Security-Policy Header
• Block Bad Bots and Scanners in Nginx
• fail2ban for Nginx
• nginx.conf Best Practices
• Nginx Location Regex Tester
• Deploy Nginx Config with GitHub Actions
• Nginx CORS Headers Configuration
• Nginx Cache-Control Headers Configuration
• Nginx 301 Redirect Map Configuration
• robots.txt, Sitemap and security.txt
• Apache .htaccess Configuration
• Docker Compose and Dockerfile Configuration
• systemd Service and Timer Configuration
• Cron Expression Explainer
• SSH Hardening with sshd_config
• Linux Firewall Rules: ufw, nftables and iptables
• Glob Pattern Tester
• Analysing Nginx Access Logs with awk
• Subnet Mask and CIDR Calculator
• VLAN Configuration on Linux
• Static Routes and Policy Routing on Linux
• NAT and Port Forwarding with nftables
• DHCP Server Configuration
• BIND Zone File Example
• WireGuard Server and Client Configuration