Infrastructure
Subnet calculator
IPv4 only — this tool does not support IPv6 prefixes.
| Network address | |
|---|---|
| Broadcast address | |
| Subnet mask | |
| Wildcard mask | |
| Total addresses | |
| Usable host range | |
| Usable hosts |
Is an IP inside a range?
Useful for confirming whether a specific address is covered by an existing security group or firewall rule.
What CIDR notation means
A CIDR block like 192.168.1.0/24 pairs a base IP address with a prefix length — the number of leading bits in a 32-bit IPv4 address that are fixed as the "network" portion, with the remaining bits free to identify individual hosts. A /24 fixes the first 24 bits (the first three octets), leaving 8 bits — 256 addresses — for hosts on that network. A smaller number after the slash means a larger range: /8 covers 16,777,216 addresses, /32 covers exactly one.
RFC 1918 private ranges
Three blocks are reserved for private networks and never routed on the public internet — the ranges behind most home routers, office networks, and VPCs:
| Range | Addresses | Typical use |
|---|---|---|
10.0.0.0/8 | 16,777,216 | Large private networks — common default for a VPC's CIDR block. |
172.16.0.0/12 | 1,048,576 | Medium private networks — Docker's default bridge network range falls in here. |
192.168.0.0/16 | 65,536 | Small private networks — most home and small office routers default to a 192.168.x.0/24 slice of this. |
Seeing one of these ranges as the source of a firewall rule generally means "anything on this private network," not a random slice of the public internet — worth checking carefully before assuming a rule is more permissive than intended.
Where this comes up in practice
CIDR ranges appear constantly when locking down network access: an EC2 security group rule's source is a CIDR block (x.x.x.x/32 for a single IP, or a wider range for an office network), and a Lightsail instance's firewall rules work the same way. Use this calculator to sanity-check a range before adding it to a rule, and the range-check tool above to confirm a specific IP — such as the one from the My IP tool — actually falls inside an existing rule.