Understanding IPv4 Subnetting: A Practical Guide

Subnetting is the process of dividing a larger IP network into smaller, self-contained sub-networks. It's one of the most practical networking skills to actually understand - it shows up in home routers, corporate networks, and every major cloud platform's VPC configuration.

This guide walks through subnetting from first principles, then applies it to the situations you'll actually run into: sizing a subnet, understanding private IP ranges, and telling public from private addresses at a glance.

Why subnet at all?

Without subnetting, every device on a network would need to be part of one enormous, flat address space. Subnetting exists to:

• Reduce broadcast traffic by keeping broadcast domains small
• Improve security by isolating groups of devices (e.g. a separate subnet for a database tier)
• Make IP address allocation efficient - a team of 10 doesn't need a block sized for 65,000
• Mirror organizational or physical structure (per office, per environment, per service tier)

The building blocks: network bits and host bits

Every IPv4 address is 32 bits. Subnetting draws a line somewhere in those 32 bits: everything before the line is the network portion (shared by every device on that subnet), and everything after is the host portion (unique to each device).

The CIDR prefix is exactly that line's position. A /24 puts the line after the 24th bit, leaving 8 host bits - 2^8 = 256 total addresses, 254 usable after subtracting the network and broadcast addresses.

Worked example: sizing a subnet for 100 devices

1. Figure out how many host bits you need: 2^n - 2 must be greater than or equal to 100. 2^7 - 2 = 126, which fits (2^6 - 2 = 62 would be too small).
2. 7 host bits means a prefix of 32 - 7 = /25.
3. A /25 gives you 126 usable host addresses - enough for 100 devices with room to grow.
4. If you started from 10.0.0.0, your subnet would be 10.0.0.0/25, with a usable range of 10.0.0.1 through 10.0.0.126.

Private IP address ranges (RFC 1918)

Three blocks of IPv4 addresses are set aside for private use and will never be assigned to a public host:

Because these ranges are private, they can be reused independently by millions of different networks worldwide without conflict - your home router's 192.168.1.0/24 network has nothing to do with anyone else's.

Public vs. private IP addresses

A public IP address is globally unique and reachable from anywhere on the internet - it's what your ISP assigns your router. A private IP address only makes sense inside its own local network; when a device with a private address needs to reach the internet, a router performs Network Address Translation (NAT) to swap it for the public address at the network's edge.

This is why you can check "what's my IP" and get one address, while your laptop's own network settings show a completely different one (like 192.168.1.42) - the public address belongs to your router, not your laptop.

Other reserved ranges worth knowing

• 127.0.0.0/8 - loopback addresses, used by a device to refer to itself (127.0.0.1, localhost)
• 169.254.0.0/16 - link-local addresses, auto-assigned when a device can't reach a DHCP server
• 100.64.0.0/10 - Carrier-Grade NAT space (RFC 6598), used by ISPs to conserve public addresses
• 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 - documentation ranges, reserved specifically for use in examples like this one

Common subnetting mistakes

• Undersizing a subnet and running out of addresses as a team or fleet grows - it's usually worth sizing with headroom.
• Forgetting that the network and broadcast addresses in a subnet aren't assignable to hosts.
• Overlapping subnet ranges when connecting two private networks (e.g. via VPN) - both sides need non-overlapping ranges.
• Assuming a private IP address is inherently secure - it isn't reachable from the public internet directly, but devices within the same private network can usually still reach each other.

Summary

Subnetting divides an IP range into smaller networks by choosing where to draw the line between network bits and host bits. The RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) cover the vast majority of internal network addressing, while NAT bridges private networks to the public internet. Once you're comfortable with the underlying binary logic, a calculator handles the repetitive arithmetic for any subnet size you need.