IP subnet basics for developers
A practical subnetting guide for reading CIDR notation, checking network ranges, planning private networks, and avoiding address conflicts.
Subnetting is not only for network engineers. Developers run into CIDR ranges when configuring firewalls, cloud networks, database allowlists, Kubernetes services, VPNs, and analytics filters.
A subnet calculator turns notation like 192.168.1.0/24 into concrete values: network address, broadcast address, usable host range, total addresses, and subnet mask.
CIDR notation and subnet masks
CIDR notation writes the network prefix after a slash. In 192.168.1.0/24, the /24 means the first 24 bits identify the network and the remaining bits identify hosts.
A longer prefix creates a smaller network. A /30 has only a few addresses, while a /16 contains many more host addresses.
Network, broadcast, and usable range
The network address identifies the subnet itself. The broadcast address is the last address in many IPv4 subnets and is not normally assigned to a host.
The usable range shows which addresses can usually be assigned to servers, containers, devices, or private services.
Private ranges and allowlists
Common private ranges include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Cloud providers often split these into smaller VPC or subnet ranges.
When adding firewall or database allowlist rules, verify the exact CIDR range so you do not open access wider than intended.
Subnet checklist
- Confirm whether the input is a single IP address or a CIDR range.
- Check network address, broadcast address, and usable host range before assigning addresses.
- Use smaller CIDR ranges for tighter firewall and database rules.
- Avoid overlapping private ranges between VPNs, VPCs, and office networks.
- Document why each allowlisted range exists.
Related guides
Learn the workflow behind this tool and what to check next.
How to troubleshoot DNS records for a domain
A practical DNS checklist for website hosting, email records, domain verification, nameserver changes, SSL certificates, and reverse DNS.
How to validate a domain before launch
A launch workflow for confirming DNS records, domain ownership signals, SSL coverage, and security headers on the public endpoint.