Subnet & CIDR Calculator (IPv4)

A subnet calculator turns an IP address and a prefix like /24 into everything you need to write a firewall rule, a VPN route or a Docker network: the network address, the subnet mask, the usable host range and the broadcast address. Getting one of these wrong is the classic cause of a split tunnel that swallows your printer, a UFW rule that locks you out of SSH, or two VPN peers fighting over the same range. This tool does the maths instantly in your browser, so nothing you type leaves your device.

How to use it

1. Type an address with a CIDR prefix, such as 192.168.1.0/24 or 10.8.0.5/24. A dotted mask also works: 172.16.5.1 255.255.0.0.
2. Read the highlighted results: the normalized network in CIDR form and the number of usable hosts.
3. Paste any address into "Is this IP inside the range?" to check whether a device, server or VPN client falls inside the network.
4. Drag "Split into subnets of" to carve the network into equal smaller blocks, for example a /24 into four /26 networks.
5. Copy the ready-to-use rules block for UFW, a WireGuard AllowedIPs line or an Nginx allow list.

Understanding the output

Network, broadcast and usable hosts

The network address is the first address in the block and identifies the subnet itself. The broadcast address is the last one. Neither is assigned to a device on a normal subnet, which is why a /24 has 256 addresses but 254 usable hosts. Two exceptions are handled automatically: a /31 point-to-point link (RFC 3021) uses both addresses, and a /32 describes a single host, which is common in firewall rules and WireGuard peer definitions.

Subnet mask vs. wildcard mask

The subnet mask (for example 255.255.255.0) marks which bits belong to the network. The wildcard mask is its inverse (0.0.0.255) and is used by Cisco-style ACLs and some routing software. The binary view shows exactly where the network bits stop, which makes odd prefixes like /20 or /27 much easier to reason about.

Address type

The tool labels well-known ranges: RFC 1918 private networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), the 100.64.0.0/10 carrier-grade NAT block that Tailscale also uses, loopback, link-local and the three documentation ranges. Anything else is shown as public.

Pro tips

• Pick non-overlapping VPN ranges. Home routers love 192.168.0.0/24 and 192.168.1.0/24. Put your WireGuard or OpenVPN tunnel on something less common, such as 10.13.13.0/24, so it never collides with hotel or office Wi-Fi.
• Use /32 for single servers. When you allow one admin IP through a firewall, a /32 is the narrowest and safest rule.
• Check Docker's defaults. Docker's bridge network usually sits in 172.17.0.0/16; if your office VPN also uses part of 172.16.0.0/12, routes can silently break.
• Split before you assign. Planning VLANs or cloud subnets is easier when you split the parent block first and give each environment its own child range.

Common mistakes and use cases

The most common mistake is writing a rule with a host address and a broad prefix, such as 192.168.1.77/24, and assuming it means "just this machine". Most tools normalize that to the whole 192.168.1.0/24 network. The calculator shows the normalized CIDR so you can see what a rule really matches.

Typical uses include:

• Split tunneling: confirming the LAN range to exclude so printers and NAS boxes stay reachable while the VPN is on. See split-tunneling rules for printers and NAS access.
• Server hardening: writing UFW rules that only allow SSH from a VPN subnet, as covered in securing an Ubuntu VPS with UFW and Fail2ban.
• Home labs: choosing ranges for Tailscale subnet routers and WireGuard peers in Tailscale and WireGuard for home lab access.
• Containers: avoiding overlap between Docker networks and VPN routes.

Further reading

The RFC 1918 private address specification defines the private ranges, and the WireGuard quick start shows how AllowedIPs uses CIDR notation for routing. When you are estimating how long a backup or migration over that network will take, the bandwidth and transfer time calculator is the natural next step.