CIDR Calculator
Calculate network address, broadcast address, subnet mask, and usable host range from an IPv4 CIDR block, and check whether an IP falls inside one.
Infrastructure
Subnet calculator
IPv4 only — this tool does not support IPv6 prefixes.
| Network address | |
|---|---|
| Broadcast address | |
| Subnet mask | |
| Wildcard mask | |
| Total addresses | |
| Usable host range | |
| Usable hosts |
Is an IP inside a range?
Useful for confirming whether a specific address is covered by an existing security group or firewall rule.
What CIDR notation means
A CIDR block like 192.168.1.0/24 pairs a base IP address with a prefix length — the number of leading bits in a 32-bit IPv4 address that are fixed as the "network" portion, with the remaining bits free to identify individual hosts. A /24 fixes the first 24 bits (the first three octets), leaving 8 bits — 256 addresses — for hosts on that network. A smaller number after the slash means a larger range: /8 covers 16,777,216 addresses, /32 covers exactly one.
RFC 1918 private ranges
Three blocks are reserved for private networks and never routed on the public internet — the ranges behind most home routers, office networks, and VPCs:
| Range | Addresses | Typical use |
|---|---|---|
10.0.0.0/8 | 16,777,216 | Large private networks — common default for a VPC's CIDR block. |
172.16.0.0/12 | 1,048,576 | Medium private networks — Docker's default bridge network range falls in here. |
192.168.0.0/16 | 65,536 | Small private networks — most home and small office routers default to a 192.168.x.0/24 slice of this. |
Seeing one of these ranges as the source of a firewall rule generally means "anything on this private network," not a random slice of the public internet — worth checking carefully before assuming a rule is more permissive than intended.
Where this comes up in practice
CIDR ranges appear constantly when locking down network access: an EC2 security group rule's source is a CIDR block (x.x.x.x/32 for a single IP, or a wider range for an office network), and a Lightsail instance's firewall rules work the same way. Use this calculator to sanity-check a range before adding it to a rule, and the range-check tool above to confirm a specific IP — such as the one from the My IP tool — actually falls inside an existing rule.