CIDR notation
CIDR notation is a compact way to write a block of IP addresses, such as 100.100.0.0/22. The part before the slash is the first address in the block. The number after the slash, called the prefix length, says how many of the address’s leading bits are fixed. The rest of the bits can vary, and every combination is an address in the block.
An IPv4 address has 32 bits, so a /22 fixes 22 bits and leaves 10 free. That’s 210, or 1,024 addresses, from 100.100.0.0 to 100.100.3.255. The first and last addresses of a block are reserved, which leaves 1,022 for hosts. A smaller prefix length means a bigger block.
Common sizes
Section titled “Common sizes”| CIDR | Addresses | Usable for hosts |
|---|---|---|
/30 | 4 | 2 |
/24 | 256 | 254 |
/22 | 1,024 | 1,022 |
/20 | 4,096 | 4,094 |
/16 | 65,536 | 65,534 |
A single address is written as a /32, like 192.168.86.5/32.
Where Managed Nebula uses CIDR notation
Section titled “Where Managed Nebula uses CIDR notation”- A network’s IPv4 range: New networks are IPv6-capable, and an IPv4 range is optional. If you add one, hosts can get an overlay address from it. It must be a private or CGNAT range between
/8and/30, and it can’t be changed later, so leave room to grow. We recommend100.100.0.0/22. See Choosing a CIDR. - Routes: A route lists the subnets a router host serves, like
192.168.86.0/24for a whole VPC subnet or192.168.86.5/32for one database. See Extend network access beyond overlay hosts. - Route firewall rules: Each rule on a route can limit access to part of its subnets with a local CIDR.
- Config overrides: Settings like
lighthouse.local_allow_listandpreferred_rangestake lists of CIDRs. See Config override keys.
On an IPv6 overlay, Defined Networking generates the network’s IPv6 range for you, so there’s no IPv6 CIDR to choose.