/32 subnet: 255.255.255.255, 1 address

A /32 has the netmask 255.255.255.255 and covers exactly 1 address, the host itself. All 32 bits are fixed, so there are no host bits, no network or broadcast address to take out, and nothing to split: 10.0.0.10/32 means 10.0.0.10 and nothing else.

The numbers

Network        10.0.0.10/32
Netmask        255.255.255.255
Wildcard       0.0.0.0
First host     10.0.0.10
Last host      10.0.0.10
Addresses      1
Usable hosts   1

There’s no broadcast row, and the tool notes A /32 is a single host address, so it is usable.

How it fits

A /31 holds two /32s, a /24 holds 256, and the whole IPv4 space, 0.0.0.0/0, holds 4,294,967,296. A bare address typed into the tool is read as a /32.

Where you’ll see it

• Allow lists. “Allow SSH from the office” is a /32 rule. AWS security groups, Azure network security groups and Google Cloud firewall rules all write a single address as a /32.
• Host routes. A route to a /32 beats any shorter route to that address, because routers pick the longest matching prefix. Calico uses that to point each local pod’s address at its interface, and MetalLB in BGP mode announces each service address as a /32.
• Loopbacks. Routers carry a /32 on a loopback interface as a stable router ID and BGP source address that doesn’t depend on any one physical link staying up.

Gotchas

• One address is fragile in an allow list. Home and mobile connections change their public address, so a /32 rule that let you in yesterday can lock you out today. A VPN or a bastion host with a fixed address is steadier than a growing list of /32s.
• A /32 on an Ethernet interface has no neighbors. With no on-link prefix, the host can’t reach even its gateway until you add a route to it explicitly, as below.
• 0.0.0.0/32 isn’t 0.0.0.0/0. The first is the single address 0.0.0.0; the second is every address. A missing or mistyped prefix in a firewall rule changes its meaning completely.

In your stack

# AWS: SSH from one address
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 \
  --protocol tcp --port 22 --cidr 203.0.113.10/32

# iptables and a host route
iptables -A INPUT -s 203.0.113.10/32 -p tcp --dport 22 -j ACCEPT
ip route add 10.0.0.10/32 via 192.168.1.1

# A /32 interface address, with its gateway made reachable by hand
ip addr add 203.0.113.10/32 dev eth0
ip route add 203.0.113.1 dev eth0
ip route add default via 203.0.113.1

# Terraform: SSH from one address
resource "aws_vpc_security_group_ingress_rule" "ssh_office" {
  security_group_id = aws_security_group.bastion.id
  cidr_ipv4         = "203.0.113.10/32"
  ip_protocol       = "tcp"
  from_port         = 22
  to_port           = 22
}

cidrhost("10.0.0.0/24", 10)            # "10.0.0.10", the tenth host of a /24

import ipaddress
list(ipaddress.ip_network("10.0.0.10/32").hosts())   # [IPv4Address('10.0.0.10')]