/24 subnet: 255.255.255.0, 256 addresses

A /24 has the netmask 255.255.255.0 and holds 256 addresses, 254 of them usable hosts: the first is the network address and the last is the broadcast address. The first three octets are fixed and the last one numbers the hosts, which makes a /24 the easiest block to read by eye. Before CIDR (RFC 4632) it was a class C network.

The numbers

Network        192.168.1.0/24
Broadcast      192.168.1.255
Netmask        255.255.255.0
Wildcard       0.0.0.255
First host     192.168.1.1
Last host      192.168.1.254
Kind           Private (RFC 1918)

How it fits

A /16 holds 256 /24s and a /23 holds two. Going the other way, a /24 splits into 2 /25s, 4 /26s, 8 /27s, 16 /28s or 64 /30s. Split into /26s, as in the tool below:

192.168.1.0/26     192.168.1.0     192.168.1.63
192.168.1.64/26    192.168.1.64    192.168.1.127
192.168.1.128/26   192.168.1.128   192.168.1.191
192.168.1.192/26   192.168.1.192   192.168.1.255

Each /26 gives up its own network and broadcast address, so four of them hold 4 × 62 = 248 hosts, not 254.

Where you’ll see it

• Home and office LANs. Many consumer routers ship with 192.168.0.0/24 or 192.168.1.0/24.
• Cloud subnets. A /24 per subnet and availability zone is a common VPC layout. AWS and Azure reserve 5 addresses in every subnet, leaving 251; Google Cloud reserves 4, leaving 252.
• Kubernetes nodes. kube-controller-manager gives each node a /24 of the cluster’s pod range by default (--node-cidr-mask-size=24), more than double the kubelet’s default limit of 110 pods. GKE does the same at 110 pods per node.
• The internet’s routing table. /24 is the longest IPv4 prefix most networks accept in BGP, so it’s the smallest block you can announce on your own.

Gotchas

• Everyone has 192.168.1.0/24. Two sites using it can’t be joined by a routed VPN, and a laptop on a home network with that range can’t reach an office subnet with the same one. Number networks that may need to meet from somewhere less common in 10.0.0.0/8 or 172.16.0.0/12.
• Cloud math isn’t 254. Size subnets with the 251 or 252 in mind, plus whatever load balancers and endpoints will take.

In your stack

# Terraform: the third /24 of a VPC, and the four /26s of a /24
cidrsubnet("10.0.0.0/16", 8, 2)                            # "10.0.2.0/24"
[for i in range(4) : cidrsubnet("192.168.1.0/24", 2, i)]   # .0/26, .64/26, .128/26, .192/26

import ipaddress
lan = ipaddress.ip_network("192.168.1.0/24")
lan.num_addresses, lan.netmask, lan.hostmask      # 256, 255.255.255.0, 0.0.0.255
[str(s) for s in lan.subnets(new_prefix=26)]

iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
nft add rule inet filter input ip saddr 192.168.1.0/24 tcp dport 22 accept

Cisco ACLs take the wildcard instead of the netmask: access-list 10 permit 192.168.1.0 0.0.0.255.