1. IP Addressing: IPv4, Subnets, Public and Private IPs
1.4 CIDR Notation and Subnet Masks
Classes madhe khup addresses waste vhaaychi. Mhanun CIDR aala. Aaj AWS VPC pasun firewall rule paryant sagla CIDR madhech lihitat.
Classes waste addresses (a company needing 500 hosts would get a whole Class B of 65,534). CIDR replaced classes. We write the address followed by /n, where n = number of network bits.
| CIDR | Subnet mask | Total addresses | Usable hosts (traditional) | Usable in AWS subnet |
|---|---|---|---|---|
| /16 | 255.255.0.0 | 65,536 | 65,534 | 65,531 |
| /20 | 255.255.240.0 | 4,096 | 4,094 | 4,091 |
| /24 | 255.255.255.0 | 256 | 254 | 251 |
| /25 | 255.255.255.128 | 128 | 126 | 123 |
| /26 | 255.255.255.192 | 64 | 62 | 59 |
| /27 | 255.255.255.224 | 32 | 30 | 27 |
| /28 | 255.255.255.240 | 16 | 14 | 11 |
| /32 | 255.255.255.255 | 1 | single host | — |
Formula: total addresses = 2^(32 − n), usable hosts = 2^(32 − n) − 2 (network address and broadcast address are reserved).
AWS reserves 5 addresses
In every AWS subnet the first four and the last IP are reserved: network address, VPC router (.1), DNS (.2), future use (.3) and the last (broadcast) address. So a /24 subnet gives 251 usable IPs. The smallest subnet AWS allows is /28 and the largest VPC is /16.
0.0.0.0/0 means "every IPv4 address" — you will see it in security groups ("anywhere") and route tables (default route).
Why this matters for security
0.0.0.0/0 in a security group means "the whole internet". SSH (22) or MySQL (3306) open to 0.0.0.0/0 is one of the most common cloud misconfigurations found in audits. For a single trusted machine, use /32 (for example 198.51.100.7/32).
Ravindra Bagale's Tip
Security group madhe /32 aani /0 madhe gondhal karu naka. /32 mhanje fakt ek IP, /0 mhanje sagla internet. Khup students "My IP" select karayche sodun 0.0.0.0/0 thevtat aani mag server var brute force suru hota. Rule save karnyadhi ekda motha kanh karun vacha: "ha rule konala allow karto?"
Practice task
How many total and usable addresses are in /27, /29 and /30? Which prefix would you use in a security group for exactly one IP?