CIDR notation appears throughout firewall rules, network configuration, and cloud provider documentation. This guide explains what it means and how to work with it practically.
What Is an IP Address, Really?
An IPv4 address like 203.0.113.10 is actually a 32-bit number, conventionally written as four decimal numbers (0-255) separated by dots.
What Is a Subnet?
A subnet is a logical subdivision of a network — a defined range of IP addresses treated as a single group for routing purposes.
Understanding CIDR Notation
203.0.113.0/24The /24 indicates how many bits of the address represent the network portion — the remaining bits identify individual hosts within that network.
Common CIDR Blocks Reference
| CIDR | Subnet Mask | Usable Addresses |
|---|---|---|
| /32 | 255.255.255.255 | 1 (a single specific host) |
| /30 | 255.255.255.252 | 2 |
| /29 | 255.255.255.248 | 6 |
| /28 | 255.255.255.240 | 14 |
| /24 | 255.255.255.0 | 254 |
| /16 | 255.255.0.0 | 65,534 |
Practical Example: Firewall Rules
sudo ufw allow from 203.0.113.10/32 to any port 22/32 here means "exactly this one IP address" — the most common CIDR notation you'll use when restricting access to a single trusted IP.
sudo ufw allow from 203.0.113.0/24 to any port 22This allows the entire range from 203.0.113.0 to 203.0.113.255 — useful for allowing an entire office or team's network range.
Private IP Address Ranges (RFC 1918)
| Range | CIDR |
|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 |
These ranges are reserved for private networks (like VPS provider internal/private networking) and are never routed on the public internet directly.
Calculating Available Hosts
The formula for usable host addresses in a subnet is 2^(32 - CIDR) - 2 (subtracting the network and broadcast addresses). For a /24: 2^8 - 2 = 254 usable addresses.
Using a CIDR Calculator
For quick reference without manual calculation, search for an online "CIDR calculator" — useful when planning firewall rules or private network ranges for multiple VPS instances.
Practical Use in VPS Networking
- Restricting SSH access to a specific office IP:
/32 - Allowing an entire team's IP range: a larger block like
/28or/24, depending on team size - Private networking between your own VPS instances: typically a
/24or/16private range
Common Errors
Firewall rule allows more/fewer IPs than intended — double-check the CIDR suffix; a common mistake is using /24 when only a single IP (/32) was actually intended, unintentionally allowing an entire range.
Related Articles
- How to Configure UFW Firewall on a Linux VPS
- How to Configure Multiple IP Addresses on One VPS
- How to Set Up a Private Network Between Multiple VPS Instances
