What a CIDR block tells you
A CIDR block such as 10.0.0.0/24 is a start address and a prefix length. The prefix says how many leading bits are fixed, here 24 of 32, so the block holds 232 - 24 = 256 addresses, from 10.0.0.0 to 10.0.0.255. The same prefix written as a subnet mask is 255.255.255.0: 24 one bits, then zeros.
On an ordinary network the first address names the network and the last is the broadcast address, so hosts get the 254 in between (RFC 1122). Two sizes are exceptions: both addresses of a /31 are usable on point-to-point links (RFC 3021), and a /32 is a single host.
Usable subnet IPs on AWS, Azure and Google Cloud
Cloud subnets keep a few more addresses for the platform, and the providers do not keep the same ones. For the default 10.0.0.0/24:
| Cloud | Reserved | Usable |
|---|---|---|
| AWS | .0 .1 .2 .3 .255 | 251 |
| Azure | .0 .1 .2 .3 .255 | 251 |
| Google Cloud | .0 .1 .254 .255 | 252 |
So the last VM address is 10.0.0.254 on AWS and Azure but 10.0.0.253 on Google Cloud, and the first is .4 on AWS and Azure but .2 on Google Cloud. Google reserves nothing in a subnet's secondary ranges, which GKE uses for Pod IPs.
Each provider also limits the subnet size. AWS accepts /16 to /28, Azure /2 to /29, and Google Cloud /4 to /29 (Google recommends no larger than /8). A /29 works on Azure and Google Cloud but not on AWS. All three refuse loopback (127.0.0.0/8), link-local (169.254.0.0/16) and multicast (224.0.0.0/4) space, and the table above flags a block that overlaps a range its provider forbids. Google Cloud also refuses the public IP addresses of Google APIs and Google Cloud itself; that list changes, so the calculator does not check it. To split a VPC into subnets per Availability Zone, use the AWS VPC subnet planner; to check a Terraform expression, the cidrsubnet calculator.
Pitfall: a host address with a prefix
10.0.1.37/22 is a valid way to say "this host, on that network", but the block it belongs to is 10.0.0.0/22. The calculator shows both. What happens to the host bits depends on the tool. The AWS EC2 API and CLI drop them: the AWS docs turn 100.68.0.18/18 into 100.68.0.0/18, and Terraform's cidrsubnet() does the same. The Terraform AWS provider's aws_subnet rejects the value instead, and Python's ipaddress.ip_network() raises an error. Write the network address so every tool reads the same block.
Netmasks, wildcard masks and IP ranges
The calculator also reads a netmask or a wildcard mask after the address. A mask that is valid both ways, such as 0.0.0.0, is read as a netmask, as Python's ipaddress module does, so it means /0. Paste a range such as 10.0.0.5 - 10.0.0.20 to get the fewest CIDR blocks that cover it exactly, ready for a firewall or security group rule.
FAQ
How many usable IP addresses are in a /24?
A /24 has 256 addresses. On an ordinary network the first (network address) and the last (broadcast) are not assigned to hosts, which leaves 254. Cloud providers keep more: AWS and Azure subnets have 251 usable addresses, and a Google Cloud subnet primary range has 252.
How do I convert a CIDR to an IP range?
The prefix length n says how many leading bits are fixed. Set the remaining 32 - n bits to 0 to get the first address and to 1 to get the last. The block holds 2^(32 - n) addresses. For 10.0.0.0/22 that is 1,024 addresses, from 10.0.0.0 to 10.0.3.255.
What is the subnet mask for /24, /16 and /28?
/24 is 255.255.255.0, /16 is 255.255.0.0 and /28 is 255.255.255.240. The mask has n one bits followed by zeros. The wildcard mask, used in Cisco ACLs and OSPF, is the inverse: 0.0.0.255 for a /24.
Which IP addresses do AWS, Azure and Google Cloud reserve in a subnet?
AWS reserves the first four addresses and the last one: the network address, the VPC router, one reserved by AWS (the Amazon DNS server sits at the VPC base plus two), one for future use, and the broadcast address. Azure also reserves the first four and the last one: network, default gateway, two for Azure DNS, and broadcast. Google Cloud reserves the first two and the last two addresses of a subnet primary range, and none in secondary ranges.
What is the smallest subnet on AWS, Azure and Google Cloud?
AWS subnets go from /16 down to /28, so the smallest has 16 addresses and 11 usable. Azure accepts /29, with 3 usable addresses, and up to /2. Google Cloud also stops at /29, with 4 usable addresses in a primary range; its shortest mask is /4, but Google recommends no larger than /8.
How do I convert an IP range to CIDR?
Split the range into the largest blocks that start on a multiple of their own size. 10.0.0.0 to 10.0.3.255 is exactly 10.0.0.0/22, but 10.0.0.5 to 10.0.0.20 needs five blocks: 10.0.0.5/32, 10.0.0.6/31, 10.0.0.8/29, 10.0.0.16/30 and 10.0.0.20/32. Paste a range such as 10.0.0.5 - 10.0.0.20 into this calculator to get the list.