Firewall Rule Calculator
Sizing a Subnet Before You Write the Rule
A firewall rule that allows or denies traffic for "10.0.4.0/24" is only meaningful if you know how many hosts that actually covers. CIDR notation packs the address range into a single prefix number, but translating that prefix into a usable host count — and confirming the subnet mask — is exactly the kind of detail worth checking before a rule goes into production.
The Formula
Usable Addresses = Total Addresses − 2 (network + broadcast reserved)
The network address and broadcast address in a subnet are reserved and not assignable to hosts, which is why usable addresses is normally two less than the total — except at /31 (2 usable, a point-to-point link exception under RFC 3021) and /32 (a single host, 1 usable).
Where This Matters
- Writing allow/deny rules — confirming exactly which and how many addresses a rule covers before applying it.
- Subnet planning — choosing a prefix length that provides enough usable addresses for a segment without wasting address space.
- Auditing existing rules — checking whether a firewall rule's range is broader than intended.
Common IPv4 CIDR Prefixes
| Prefix | Total addresses | Usable addresses |
|---|---|---|
| /16 | 65,536 | 65,534 |
| /20 | 4,096 | 4,094 |
| /24 | 256 | 254 |
| /26 | 64 | 62 |
| /28 | 16 | 14 |
| /30 | 4 | 2 |
| /31 | 2 | 2 (point-to-point exception) |
| /32 | 1 | 1 (single host) |
Computed from Total = 2^(32-prefix); Usable = Total - 2 for all prefixes except /31 and /32.
How to Use This Calculator
- Enter the CIDR Prefix Length (0–32) for the IPv4 subnet or rule range in question.
- Select Calculate to get the subnet mask, total addresses, and usable addresses.
Related Calculations
Once the rule scope is confirmed, consider whether it should apply behind a VPN, or assess the severity of the vulnerability the rule is meant to mitigate with the CVSS Score Calculator.