Blog
3 min read

CIDR Notation Explained: What /24, /16 and /32 Mean

CIDR notation like 192.168.1.0/24 describes a range of IP addresses in one line — you'll meet it in firewall rules, database access lists and cloud networking. What the slash number means, a cheat sheet of common sizes, how to allow a single IP, and the mistakes that open your server to the whole internet.

CIDR notation is a compact way to write a range of IP addresses: an address, a slash, and a number.

192.168.1.0/24

You'll meet it everywhere you control network access: firewall rules, cloud security groups, database allowlists ("allow connections from 203.0.113.7/32"), and Docker or VPN settings. (What Is an IP Address?)

What the number after the slash means

An IPv4 address is 32 bits long. The number after the slash says how many of those bits are fixed. The rest can vary, and every combination of them is in the range.

  • /32 — all 32 bits fixed → exactly one address.
  • /24 — first 24 bits fixed, last 8 vary → 256 addresses.
  • /16 — first 16 fixed → 65,536 addresses.
  • /0 — nothing fixed → every IPv4 address on the internet.

Smaller number = bigger range.

Cheat sheet

CIDR Addresses Example Covers
/32 1 203.0.113.7/32 Just 203.0.113.7
/30 4 10.0.0.4/30 10.0.0.4 – 10.0.0.7
/28 16 10.0.0.16/28 10.0.0.16 – 10.0.0.31
/24 256 192.168.1.0/24 192.168.1.0 – 192.168.1.255
/16 65,536 172.16.0.0/16 172.16.0.0 – 172.16.255.255
/8 16.7 million 10.0.0.0/8 10.0.0.0 – 10.255.255.255
/0 everything 0.0.0.0/0 The whole internet

With /8, /16 and /24, the fixed part lines up neatly with the dots: /24 means "the first three numbers are fixed".

Common uses

Allow one IP (your office, a CI runner) to reach a database:

sudo ufw allow from 203.0.113.7/32 to any port 5432

(UFW Firewall Basics)

Allow a private network: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are the private IPv4 ranges. Docker networks, cloud private networks and home Wi-Fi live in these.

Open to everyone: 0.0.0.0/0 (and ::/0 for IPv6). Correct for ports 80 and 443 on a web server; dangerous almost anywhere else.

The mistake that matters

The classic security error is allowing 0.0.0.0/0 on a database or SSH port "just to get it working". That exposes it to the entire internet, where bots scan constantly for open Postgres, MySQL, Redis and SSH ports. Allow specific addresses instead, or keep the service on a private network. (Brute-Force Attacks)

IPv6 CIDR

Same idea, bigger numbers: IPv6 addresses are 128 bits, so /128 is one address and /64 is a standard single network (an enormous number of addresses). ::/0 means all IPv6 addresses.

Working it out

You don't need to do binary in your head. Use ipcalc on Linux, or any online CIDR calculator:

ipcalc 192.168.1.0/24

The summary

  • CIDR = address + /number; the number is how many bits are fixed.
  • /32 is one IP, /24 is 256, /0 is everything.
  • Never open database or SSH ports to 0.0.0.0/0.

EasySpawn keeps your database on the same private server as your app, so it never needs to be opened to the internet in the first place. See how it works or join the waitlist.

Related: Ports Explained · IPv4 vs IPv6 · Secure a New VPS · Principle of Least Privilege

Keep reading