/27 subnet: 255.255.255.224, 32 addresses

A /27 has the netmask 255.255.255.224 and holds 32 addresses, 30 of them usable hosts. A /24 holds eight of them, starting at .0, .32, .64, .96, .128, .160, .192 and .224. 10.0.0.32/27 runs from 10.0.0.32 to 10.0.0.63; the next address, 10.0.0.64, is already outside it, as the tool below shows.

The numbers

Network        10.0.0.32/27
Broadcast      10.0.0.63
Netmask        255.255.255.224
Wildcard       0.0.0.31
First host     10.0.0.33
Last host      10.0.0.62

How it fits

A /24 holds 8 /27s and a /16 holds 2,048. A /27 splits into 2 /28s or 4 /29s.

Where you’ll see it

• AWS load balancer subnets. An Application Load Balancer needs subnets of at least /27, with at least 8 free addresses, in each zone it uses. A /27 there leaves 27 after AWS’s 5 reserved addresses.
• Azure gateways. VPN and ExpressRoute gateways run in a subnet named GatewaySubnet, and Azure recommends /27 or larger for it so later gateway configurations still fit.
• Small tiers and VLANs. A management network, a printer VLAN or a handful of appliances: up to 30 hosts on premises, 27 on AWS or Azure, 28 on Google Cloud.

Gotchas

• The edges are taken. .63 is the broadcast address of 10.0.0.32/27 and .64 the network address of 10.0.0.64/27, so neither is a host on either side of that line. The same goes for every multiple of 32 and the address just before it.
• Things that scale take addresses. Anything that gets an address per instance, task or pod, like an autoscaling group or ECS tasks in awsvpc mode, can exhaust 27 addresses quickly, and an AWS subnet’s CIDR can’t be resized after it’s created. Give those workloads larger subnets and keep the /27s for what stays small.

In your stack

# Terraform: the second /27 of a /24
cidrsubnet("10.0.0.0/24", 3, 1)           # "10.0.0.32/27"

import ipaddress
[str(n) for n in ipaddress.ip_network("10.0.0.0/24").subnets(new_prefix=27)][:3]
# ['10.0.0.0/27', '10.0.0.32/27', '10.0.0.64/27']
ipaddress.ip_address("10.0.0.64") in ipaddress.ip_network("10.0.0.32/27")   # False

! Cisco extended ACL: traffic from the block to anywhere
access-list 110 permit ip 10.0.0.32 0.0.0.31 any