Skip to main content

CIDR is a shorthand for specifying IP address ranges using a slash notation.

# IPv4 CIDR Notation Reference Guide

## What is CIDR?

**CIDR (Classless Inter-Domain Routing)** is a shorthand notation for specifying IP address ranges using a slash followed by a number.

### Format

```
<IP Address>/<Prefix Length>
```

- **IP Address**: The network address (e.g., `192.168.1.0`)
- **Prefix Length**: Number of bits in the network portion (e.g., `/24`)

## How CIDR Works

The `/number` (prefix length) indicates how many bits, starting from the left, are fixed for the network portion of the address. The remaining bits are available for host addresses.

### Key Principles

- **Smaller prefix number** = **more addresses** in the range
- **Larger prefix number** = **fewer addresses** in the range
- Valid range: **`/0` to `/32`**
- Formula: **Number of IPs = 2^(32 - prefix length)**

### Binary Breakdown

Each bit in the 32-bit IPv4 address can be either part of the network or host portion:

```
/0  = 00000000.00000000.00000000.00000000 (all hosts)
/8  = 11111111.00000000.00000000.00000000 (first octet fixed)
/16 = 11111111.11111111.00000000.00000000 (first two octets)
/24 = 11111111.11111111.11111111.00000000 (first three octets)
/32 = 11111111.11111111.11111111.11111111 (exact address)
```

## Complete CIDR Reference Table

| CIDR  | Subnet Mask     | Total IPs     | Usable IPs\* | Typical Use Case                           |
| ----- | --------------- | ------------- | ------------ | ------------------------------------------ |
| `/0`  | 0.0.0.0         | 4,294,967,296 | All          | All IPv4 addresses (default route)         |
| `/8`  | 255.0.0.0       | 16,777,216    | 16,777,214   | Large enterprise networks, cloud providers |
| `/12` | 255.240.0.0     | 1,048,576     | 1,048,574    | Large corporate networks                   |
| `/16` | 255.255.0.0     | 65,536        | 65,534       | Medium networks, Azure VNets               |
| `/20` | 255.255.240.0   | 4,096         | 4,094        | Departmental networks                      |
| `/24` | 255.255.255.0   | 256           | 254          | Small subnets (default LANs)               |
| `/26` | 255.255.255.192 | 64            | 62           | Small office networks                      |
| `/28` | 255.255.255.240 | 16            | 14           | Very small subnets                         |
| `/30` | 255.255.255.252 | 4             | 2            | Point-to-point links                       |
| `/32` | 255.255.255.255 | 1             | 1            | Single host/firewall rules                 |

\*Usable IPs = Total - 2 (network + broadcast addresses), except `/31` and `/32`

## Private IP Address Ranges

These CIDR blocks are reserved for private networks (RFC 1918):

- **`10.0.0.0/8`** - Large private networks (16.7M IPs)
- **`172.16.0.0/12`** - Medium private networks (1M IPs)
- **`192.168.0.0/16`** - Small private networks (65K IPs)

## Quick Calculation Examples

- `/24` = 2^(32-24) = 2^8 = **256 IPs**
- `/28` = 2^(32-28) = 2^4 = **16 IPs**
- `/16` = 2^(32-16) = 2^16 = **65,536 IPs**
- `/32` = 2^(32-32) = 2^0 = **1 IP**

## Practical Examples

### 1. Azure Network Security Group (NSG) - Allow Office Traffic

```
Source: 203.0.113.0/24
Destination: 10.0.1.0/24
Action: Allow
```

Allows all 256 IPs from office network to reach a specific subnet.

### 2. Azure Cosmos DB Firewall - Allow Single Admin IP

```
Allowed IP: 198.51.100.42/32
```

Grants access only to one specific administrator's public IP.

### 3. Azure Virtual Network - Hub Network

```
VNet Address Space: 10.0.0.0/16
```

Provides 65,536 IPs for hub network with multiple subnets.

### 4. Azure Subnet - Web Tier

```
Subnet: 10.0.1.0/24
```

Allocates 256 IPs for web servers (254 usable).

### 5. Azure Subnet - Database Tier

```
Subnet: 10.0.2.0/26
```

Allocates 64 IPs for database servers (62 usable).

### 6. Azure Application Gateway Subnet

```
Subnet: 10.0.3.0/28
```

Minimum recommended size (16 IPs) for Application Gateway.

### 7. Azure Route Table - Default Route

```
Address Prefix: 0.0.0.0/0
Next Hop: Virtual Appliance
```

Routes all internet traffic through a firewall.

### 8. Azure Private Endpoint Subnet

```
Subnet: 10.0.4.0/28
```

Small subnet dedicated to private endpoints (16 IPs).

### 9. Azure Container Apps Environment

```
Infrastructure Subnet: 10.0.5.0/23
```

Provides 512 IPs for container infrastructure (2^(32-23) = 512).

### 10. Multi-Region Azure Setup

```
Region 1 (East US):    10.0.0.0/16   (65,536 IPs)
Region 2 (West US):    10.1.0.0/16   (65,536 IPs)
Region 3 (North EU):   10.2.0.0/16   (65,536 IPs)
```

Each region gets its own `/16` block for isolation and growth.

## Common Patterns Summary

| Scenario                   | Recommended CIDR | Reason                    |
| -------------------------- | ---------------- | ------------------------- |
| Single host firewall rule  | `/32`            | Exact IP match            |
| Point-to-point VPN link    | `/30`            | Only 2 usable IPs needed  |
| Small subnet (App Gateway) | `/28`            | 16 IPs, minimal waste     |
| Standard subnet            | `/24`            | 256 IPs, easy to remember |
| Large subnet               | `/16`            | 65K IPs, room for growth  |
| "Any" or default route     | `/0`             | All IP addresses          |

## Tips for Choosing CIDR Ranges

1. **Plan for growth** - Choose larger ranges than you currently need
2. **Avoid overlap** - Ensure ranges don't conflict across VNets or on-premises
3. **Use consistent sizing** - Standardize subnet sizes where possible (e.g., all app subnets `/24`)
4. **Document everything** - Keep a spreadsheet of allocated ranges
5. **Reserve space** - Leave gaps between allocations for future expansion