> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CIDR Notation Explained

> Understand CIDR notation for IP ranges. Learn how to calculate subnets, authorize networks, and use CIDR in KnoxCall.

# CIDR Notation Explained

Learn how to use CIDR (Classless Inter-Domain Routing) notation to authorize ranges of IP addresses in KnoxCall.

***

## What is CIDR?

**CIDR** (pronounced "cider") is a way to represent a **range of IP addresses** using a single notation.

### Format

```text theme={"dark"}
IP_ADDRESS/PREFIX_LENGTH
```

**Example:**

```text theme={"dark"}
192.168.1.0/24
```

**Parts:**

* `192.168.1.0` - Network address (base IP)
* `/24` - Prefix length (how many IPs in range)

***

## Why Use CIDR?

### The Problem Without CIDR

Imagine authorizing an office with 200 employees:

```text theme={"dark"}
❌ Without CIDR (tedious):
192.168.1.1
192.168.1.2
192.168.1.3
...
192.168.1.200

(Need 200 separate client entries!)
```

### The Solution With CIDR

```text theme={"dark"}
✅ With CIDR (one entry):
192.168.1.0/24

(Covers 192.168.1.1 to 192.168.1.254 - all 254 usable IPs!)
```

***

## How CIDR Works

### The Prefix Number

The number after the `/` tells you how many IPs are in the range.

**Formula:**

```text theme={"dark"}
Number of IPs = 2^(32 - prefix)
```

**Examples:**

```text theme={"dark"}
/32 → 2^(32-32) = 2^0  = 1 IP
/24 → 2^(32-24) = 2^8  = 256 IPs
/16 → 2^(32-16) = 2^16 = 65,536 IPs
/8  → 2^(32-8)  = 2^24 = 16,777,216 IPs
```

### Common CIDR Ranges

| CIDR  | IPs    | Common Use         | Example           |
| ----- | ------ | ------------------ | ----------------- |
| `/32` | 1      | Single host        | `52.123.45.67/32` |
| `/30` | 4      | Point-to-point     | `10.0.0.0/30`     |
| `/28` | 16     | Small subnet       | `192.168.1.0/28`  |
| `/24` | 256    | **Office network** | `192.168.1.0/24`  |
| `/20` | 4,096  | Large network      | `172.31.0.0/20`   |
| `/16` | 65,536 | **Corporate VPN**  | `10.0.0.0/16`     |
| `/8`  | 16M+   | Very large         | `10.0.0.0/8`      |

***

## /24 - Most Common (256 IPs)

### Example: Office Network

```text theme={"dark"}
CIDR: 192.168.1.0/24
```

**Range covered:**

```text theme={"dark"}
First IP:  192.168.1.0   (network address - reserved)
Usable:    192.168.1.1   to   192.168.1.254
Last IP:   192.168.1.255 (broadcast - reserved)

Total: 256 addresses
Usable: 254 addresses (for devices)
```

**What changes:**

* Last octet (number): 0 to 255
* Everything else stays the same

**Authorizes:**

```text theme={"dark"}
✅ 192.168.1.1    (office computer)
✅ 192.168.1.50   (another computer)
✅ 192.168.1.100  (developer laptop)
✅ 192.168.1.254  (last usable)
❌ 192.168.2.1    (different subnet!)
❌ 192.168.0.255  (different subnet!)
```

***

## /16 - Large Networks (65,536 IPs)

### Example: Corporate VPN

```text theme={"dark"}
CIDR: 10.8.0.0/16
```

**Range covered:**

```text theme={"dark"}
First IP:  10.8.0.0
Usable:    10.8.0.1   to   10.8.255.254
Last IP:   10.8.255.255

Total: 65,536 addresses
```

**What changes:**

* Last TWO octets: 0.0 to 255.255
* First two stay the same: 10.8

**Authorizes:**

```text theme={"dark"}
✅ 10.8.0.1       (VPN user 1)
✅ 10.8.0.50      (VPN user 50)
✅ 10.8.100.200   (VPN user on different subnet)
✅ 10.8.255.254   (last usable)
❌ 10.7.0.1       (different network)
❌ 10.9.0.1       (different network)
```

***

## /20 - Cloud Subnets (4,096 IPs)

### Example: AWS VPC Subnet

```text theme={"dark"}
CIDR: 172.31.0.0/20
```

**Range covered:**

```text theme={"dark"}
First IP:  172.31.0.0
Usable:    172.31.0.1   to   172.31.15.254
Last IP:   172.31.15.255

Total: 4,096 addresses
```

**What changes:**

* Last octet: Full range (0-255)
* Third octet: Partial range (0-15)

**Authorizes:**

```text theme={"dark"}
✅ 172.31.0.1     (EC2 instance)
✅ 172.31.5.100   (another instance)
✅ 172.31.15.254  (last usable)
❌ 172.31.16.1    (outside range - /20 only goes to .15)
❌ 172.30.0.1     (different network)
```

***

## /32 - Single IP (Don't Use CIDR)

### Example: Single Server

```text theme={"dark"}
CIDR: 52.123.45.67/32
```

**Range covered:**

```text theme={"dark"}
Just: 52.123.45.67

Total: 1 address (only this specific IP)
```

**Note:** In KnoxCall, just enter `52.123.45.67` without `/32`. It's implied.

***

## Calculating CIDR Ranges

### Quick Method

**Step 1: Look at the prefix**

```text theme={"dark"}
/24 → Last octet varies (256 IPs)
/16 → Last 2 octets vary (65,536 IPs)
/8  → Last 3 octets vary (16M IPs)
```

**Step 2: Calculate range**

```text theme={"dark"}
/24 example: 192.168.1.0/24
- Base: 192.168.1.0
- Range: 192.168.1.0 to 192.168.1.255
- Usable: 192.168.1.1 to 192.168.1.254
```

### CIDR Calculator Tools

**Online calculators:**

* [https://www.ipaddressguide.com/cidr](https://www.ipaddressguide.com/cidr)
* [https://cidr.xyz/](https://cidr.xyz/)
* [https://www.subnet-calculator.com/](https://www.subnet-calculator.com/)

**Example:**

```text theme={"dark"}
Input:  192.168.1.0/24
Output: First: 192.168.1.0
        Last:  192.168.1.255
        Usable: 192.168.1.1 - 192.168.1.254
```

***

## Common Scenarios

### Scenario 1: Office Wi-Fi

**Need:** Authorize all 50 office computers

**Solution:**

```text theme={"dark"}
CIDR: 192.168.1.0/24
```

**Why /24:**

* Office has 50 devices now
* Room to grow to 254 devices
* Typical office network size

**Client in KnoxCall:**

```text theme={"dark"}
Name: office-wifi-main
Type: Server
IP: 192.168.1.0/24
Description: Main office Wi-Fi network
```

### Scenario 2: Corporate VPN

**Need:** Authorize 500 remote employees

**Solution:**

```text theme={"dark"}
CIDR: 10.8.0.0/16
```

**Why /16:**

* VPN has 500 users now
* Room for 65,000+ connections
* Standard VPN range

**Client in KnoxCall:**

```text theme={"dark"}
Name: company-vpn
Type: Server
IP: 10.8.0.0/16
Description: Corporate VPN - all remote workers
```

### Scenario 3: AWS Subnet

**Need:** Authorize EC2 instances in subnet

**Solution:**

```text theme={"dark"}
CIDR: 172.31.0.0/20
```

**Why /20:**

* AWS VPC subnet
* \~4,000 IPs
* Multiple microservices

**Client in KnoxCall:**

```text theme={"dark"}
Name: aws-prod-subnet
Type: Server
IP: 172.31.0.0/20
Description: AWS VPC subnet - production instances
```

### Scenario 4: Partner Network

**Need:** Authorize partner company's entire network

**Solution:**

```text theme={"dark"}
CIDR: 203.14.0.0/24
```

**Why /24:**

* Partner has small office
* \~100 employees
* /24 covers them

**Client in KnoxCall:**

```text theme={"dark"}
Name: partner-acme-network
Type: Server
IP: 203.14.0.0/24
Description: ACME Corp office network
```

***

## Testing CIDR Ranges

### How to Test

**Step 1: Create client with CIDR**

```text theme={"dark"}
IP: 192.168.1.0/24
```

**Step 2: Test from different IPs**

**From 192.168.1.50:**

```bash theme={"dark"}
curl https://a1b2c3d4.acme.knoxcall.com/api/test \
  -H "x-knoxcall-route: test-route"

✅ Success: 200 OK (IP in range!)
```

**From 192.168.2.50:**

```bash theme={"dark"}
curl https://a1b2c3d4.acme.knoxcall.com/api/test \
  -H "x-knoxcall-route: test-route"

❌ Error: 403 Forbidden (IP not in range)
```

***

## Private IP Ranges

### Reserved Private Networks

These IP ranges are for **internal networks only** (not internet-routable):

**Class A (Large):**

```text theme={"dark"}
10.0.0.0/8
- Range: 10.0.0.0 to 10.255.255.255
- IPs: 16,777,216
- Use: Large corporate networks, VPNs
```

**Class B (Medium):**

```text theme={"dark"}
172.16.0.0/12
- Range: 172.16.0.0 to 172.31.255.255
- IPs: 1,048,576
- Use: Medium networks, cloud providers (AWS uses 172.31.0.0/16)
```

**Class C (Small):**

```text theme={"dark"}
192.168.0.0/16
- Range: 192.168.0.0 to 192.168.255.255
- IPs: 65,536
- Use: Home/office networks (most common: 192.168.1.0/24)
```

**Note:** Private IPs only work for:

* Office networks (devices behind router)
* VPNs (tunnel private network over internet)
* Cloud private subnets

**Don't use for:**

* Public internet servers (use public IPs)

***

## Public vs Private IPs

### Public IPs (Internet)

```text theme={"dark"}
Examples:
52.123.45.67        (AWS Elastic IP)
104.21.45.67        (Cloudflare)
142.250.185.78      (Google)

Format: Any IP not in private ranges
CIDR: Typically /32 (single IP) or /24 (small block)
```

**Use in KnoxCall:**

* Production servers
* Partner webhooks
* Public APIs

### Private IPs (Internal Networks)

```text theme={"dark"}
Examples:
192.168.1.0/24      (Office Wi-Fi)
10.8.0.0/16         (Corporate VPN)
172.31.0.0/20       (AWS VPC private subnet)

Format: 10.x.x.x, 172.16-31.x.x, 192.168.x.x
CIDR: Often /16 or /24
```

**Use in KnoxCall:**

* Office networks
* VPN access
* Internal testing

***

## Common Mistakes

### ❌ Mistake 1: Using /32 for Networks

```text theme={"dark"}
❌ Wrong:
IP: 192.168.1.1/32
Type: Server

Problem: /32 = only 1 IP (defeats purpose)
```

**Fix:**

```text theme={"dark"}
✅ Correct:
IP: 192.168.1.0/24
Type: Server
```

### ❌ Mistake 2: Too Broad Range

```text theme={"dark"}
❌ Dangerous:
IP: 0.0.0.0/0

Problem: Allows ENTIRE internet!
```

**Fix:**

```text theme={"dark"}
✅ Correct:
IP: 192.168.1.0/24 (specific network only)
```

### ❌ Mistake 3: Wrong Base IP

```text theme={"dark"}
❌ Wrong:
IP: 192.168.1.55/24

Problem: Base should be .0 not .55
```

**Fix:**

```text theme={"dark"}
✅ Correct:
IP: 192.168.1.0/24
```

### ❌ Mistake 4: Prefix Doesn't Match Network

```text theme={"dark"}
❌ Wrong:
Need: 50 IPs
Used: 10.0.0.0/8 (16 million IPs!)

Problem: Massively oversized
```

**Fix:**

```text theme={"dark"}
✅ Correct:
Need: 50 IPs
Used: 10.0.0.0/24 (256 IPs - enough headroom)
```

***

## CIDR Cheat Sheet

| Prefix | IPs     | Typical Use                         |
| ------ | ------- | ----------------------------------- |
| `/32`  | 1       | Single server (don't use CIDR)      |
| `/30`  | 4       | Point-to-point link                 |
| `/29`  | 8       | Very small subnet                   |
| `/28`  | 16      | Small office                        |
| `/27`  | 32      | Small network                       |
| `/26`  | 64      | Medium office                       |
| `/25`  | 128     | Large office                        |
| `/24`  | 256     | **Standard office network**         |
| `/23`  | 512     | Large office/campus                 |
| `/22`  | 1,024   | Campus network                      |
| `/21`  | 2,048   | Large network                       |
| `/20`  | 4,096   | **Cloud subnet (AWS)**              |
| `/19`  | 8,192   | Large cloud network                 |
| `/18`  | 16,384  | Very large network                  |
| `/17`  | 32,768  | Enterprise                          |
| `/16`  | 65,536  | **Corporate VPN, large enterprise** |
| `/15`  | 131,072 | ISP                                 |
| `/14`  | 262,144 | Large ISP                           |
| `/13`  | 524,288 | Very large ISP                      |
| `/12`  | 1M+     | Regional network                    |
| `/11`  | 2M+     | National network                    |
| `/10`  | 4M+     | Continental network                 |
| `/9`   | 8M+     | Very large network                  |
| `/8`   | 16M+    | **Class A network**                 |

***

## Tools & Resources

### CIDR Calculators

**IP Address Guide:**
[https://www.ipaddressguide.com/cidr](https://www.ipaddressguide.com/cidr)

**CIDR.xyz:**
[https://cidr.xyz/](https://cidr.xyz/)

**Subnet Calculator:**
[https://www.subnet-calculator.com/](https://www.subnet-calculator.com/)

### Command Line Tools

**Test if IP is in CIDR range:**

```bash theme={"dark"}
# Using Python
python3 -c "
import ipaddress
network = ipaddress.ip_network('192.168.1.0/24')
ip = ipaddress.ip_address('192.168.1.50')
print(ip in network)  # True or False
"
```

**List all IPs in range:**

```bash theme={"dark"}
# Using Python
python3 -c "
import ipaddress
for ip in ipaddress.ip_network('192.168.1.0/24'):
    print(ip)
"
```

***

## Best Practices

### ✅ Do

1. **Use smallest range needed**
   ```
   ✅ Office has 50 users → /24 (256 IPs)
   ❌ Office has 50 users → /16 (65,536 IPs)
   ```

2. **Use .0 as base**
   ```
   ✅ 192.168.1.0/24
   ❌ 192.168.1.1/24
   ```

3. **Document what's in range**
   ```
   Description: "Main office Wi-Fi - floors 1-3, ~100 employees"
   ```

4. **Test before production**
   ```
   Test with curl from expected IP range
   Verify rejection from outside range
   ```

5. **Use private IPs for internal**
   ```
   ✅ 192.168.1.0/24 for office
   ✅ 10.8.0.0/16 for VPN
   ```

### ❌ Don't

1. **Don't use 0.0.0.0/0**
   ```
   ❌ Allows entire internet (defeats purpose!)
   ```

2. **Don't over-authorize**
   ```
   ❌ Need 10 IPs → /8 (16 million!)
   ✅ Need 10 IPs → /28 (16 IPs)
   ```

3. **Don't forget private vs public**
   ```
   ❌ Using 192.168.1.0/24 for internet servers
   ✅ Using public IP for internet servers
   ```

4. **Don't mix ranges**
   ```
   ❌ One client for unrelated networks
   ✅ Separate clients for separate networks
   ```

***

## Quick Reference

| Your Network               | Recommended CIDR        | IPs    |
| -------------------------- | ----------------------- | ------ |
| **Single server**          | `52.123.45.67` (no /32) | 1      |
| **Small office** (\< 20)   | `192.168.1.0/28`        | 16     |
| **Medium office** (\< 100) | `192.168.1.0/24`        | 256    |
| **Large office** (\< 500)  | `192.168.0.0/23`        | 512    |
| **VPN** (\< 1000)          | `10.8.0.0/22`           | 1,024  |
| **Large VPN** (\< 10k)     | `10.0.0.0/18`           | 16,384 |
| **Enterprise VPN**         | `10.0.0.0/16`           | 65,536 |
| **AWS Subnet**             | `172.31.0.0/20`         | 4,096  |

***

## Next Steps

<CardGroup cols={2}>
  <Card title="What are Clients?" icon="users" href="/essentials/clients/what-are-clients">
    Client basics and IP whitelisting
  </Card>

  <Card title="Client Types" icon="list" href="/essentials/clients/client-types">
    Server, User, and Network types
  </Card>

  <Card title="Managing Clients" icon="wrench" href="/essentials/clients/managing-clients">
    Create and assign clients
  </Card>

  <Card title="IP Issues" icon="ban" href="/troubleshooting/ip-authorization-issues">
    Troubleshoot IP problems
  </Card>
</CardGroup>

***

<Info>
  **Quick Tip:** For most offices, `/24` (256 IPs) is perfect. For VPNs, `/16` (65,536 IPs) gives plenty of headroom. When in doubt, use a CIDR calculator!
</Info>