A router can show a local address such as `192.168.1.25`, a subnet mask of `255.255.255.0`, and a public IP address assigned by your ISP – all at the same time. This IPv4 subnet mask guide explains what the mask actually does, how to read CIDR notation, and why it matters when you are setting up devices, opening ports, or tracking down a network problem.
What an IPv4 subnet mask does
An IPv4 address identifies a device or network interface using four numbers separated by periods. Each number ranges from 0 to 255, so an address might look like `192.168.1.25`. By itself, though, that address does not tell a device which part identifies the local network and which part identifies the individual device.
The subnet mask supplies that boundary. It tells a computer, phone, router, or server which addresses are local and which traffic must be sent to the default gateway for routing elsewhere.
For example, consider these settings:
`IP address: 192.168.1.25` `Subnet mask: 255.255.255.0` `Default gateway: 192.168.1.1`
With that mask, addresses from `192.168.1.0` through `192.168.1.255` belong to the same local subnet. A device can send traffic directly to another local address, such as `192.168.1.50`. To reach an address outside that range, such as a website server on the internet, it sends the traffic to the router at `192.168.1.1`.
A useful comparison is a street address. The subnet mask identifies the neighborhood, while the remaining part of the IP address identifies a particular house in that neighborhood. Routers use the neighborhood portion to decide where traffic should go next.
Reading subnet masks and CIDR notation
Subnet masks are often written in dotted-decimal form, such as `255.255.255.0`. Networking tools also use CIDR notation, which writes the address followed by a slash and a number, such as `192.168.1.25/24`.
The `/24` means the first 24 binary bits identify the network. An IPv4 address contains 32 bits total, leaving 8 bits for host addresses. A `/24` is exactly the same as `255.255.255.0`.
You do not need to convert every address to binary for routine troubleshooting, but understanding the pattern makes subnet sizes easier to recognize. Common masks include:
| CIDR | Subnet mask | Total addresses | Typical use | | — | — | —: | — | | `/24` | `255.255.255.0` | 256 | Home and small-office LANs | | `/25` | `255.255.255.128` | 128 | Splitting one /24 into two networks | | `/26` | `255.255.255.192` | 64 | Small VLANs or segmented device groups | | `/27` | `255.255.255.224` | 32 | Small service or management networks | | `/16` | `255.255.0.0` | 65,536 | Large private network ranges |
Most conventional IPv4 subnets reserve two addresses: one network address and one broadcast address. That means a `/24` has 254 usable host addresses, not 256. A `/26` has 62 usable host addresses. There are exceptions for specialized point-to-point configurations, but the two-address rule is the right working assumption for home, office, and server networks.
How to find the network range
The fastest way to understand a subnet is to identify its block size. For masks that change in the last octet, subtract that octet from 256.
Take the mask `255.255.255.192`. The changed octet is 192, so `256 – 192 = 64`. Each subnet starts at a multiple of 64:
`192.168.1.0` `192.168.1.64` `192.168.1.128` `192.168.1.192`
If your device is `192.168.1.130/26`, it belongs to the subnet beginning at `192.168.1.128`. The network address is `192.168.1.128`, the usable host range is `192.168.1.129` through `192.168.1.190`, and the broadcast address is `192.168.1.191`.
This matters when devices appear to be on the same network because their addresses look similar. A device at `192.168.1.60/26` is not on the same subnet as `192.168.1.130/26`, even though both start with `192.168.1`. They need a router to communicate.
Why subnet masks affect everyday troubleshooting
A wrong subnet mask can produce confusing symptoms. A computer may reach the internet but fail to communicate with a printer. A game server may work for devices on one VLAN but not another. A static IP camera may appear online until another device receives a conflicting DHCP lease.
In a typical home network, the router’s DHCP service assigns an IP address, subnet mask, gateway, and DNS servers automatically. Manually assigned addresses must match the local network settings. If the router uses `192.168.50.1/24`, a device configured as `192.168.1.20/24` is on a different subnet and will not reach the router without additional routing.
The same distinction applies to port forwarding. A port-forwarding rule points inbound traffic from your router to a specific private IPv4 address. If that device receives a new address from DHCP, the rule can point to the wrong system. Reserve the address in the router’s DHCP settings or configure a carefully chosen static address outside the dynamic pool but inside the correct subnet.
Your public IPv4 address is separate from your private LAN addressing. A subnet mask such as `255.255.255.0` does not make an address public or private. Private IPv4 ranges are defined separately: `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`. Your router commonly uses Network Address Translation, or NAT, to let many private devices share one public address provided by the ISP.
Choosing the right subnet size
For most homes, a `/24` network is practical and simple. It supports up to 254 usable addresses, which is more than enough for phones, TVs, computers, smart-home gear, and guest devices. There is usually no benefit to changing it merely because the network has only a few devices.
Smaller subnets make sense when you are deliberately separating systems. A small business might place staff computers, guest Wi-Fi, cameras, and servers on separate VLANs. In that case, a `/26` or `/27` can limit broadcast traffic and make address management clearer. Segmentation can also support security rules, but a subnet alone does not block traffic. You still need firewall or router rules between networks.
Larger subnets are not automatically better. A `/16` allows many addresses, but it also creates a broad local broadcast domain if used as one flat network. That can make troubleshooting, access control, and device discovery harder. The right size depends on how many devices you have, whether you use VLANs, and whether the network needs to grow.
Quick checks when an address will not work
When a device cannot reach a local resource or the internet, check the IP address, subnet mask, default gateway, and DNS settings together. One correct value does not compensate for another incorrect one.
First, confirm that the device address is inside the intended local subnet. Next, verify that the default gateway is an address within that same subnet. Then check for duplicate addresses, especially on devices configured manually. Finally, test the path in order: ping the local gateway, test a known public IP address, and then test a domain name. If a public IP responds but a domain does not, DNS is the likely issue rather than the subnet mask.
On a home connection, also compare the router’s WAN address with the public IPv4 address reported by an external IP-checking service such as WhatIsMyPublicIP.com. If they do not match, your ISP may be using carrier-grade NAT. That can affect inbound port forwarding even when your internal subnet settings are correct.
A practical IPv4 subnet mask guide for common setups
Use `255.255.255.0` or `/24` when you need a straightforward home or small-office network. Keep devices that must communicate directly on the same subnet, and use the router or firewall to connect separate subnets. If you assign static addresses, document the DHCP range, gateway, DNS servers, and reserved addresses so future changes do not create conflicts.
Subnet masks are not just an exam topic or a router setting you can ignore. They are the rule that tells every device where local traffic ends and routing begins. Once you can read that boundary, problems involving printers, game hosts, remote access, IP cameras, and port forwarding become much easier to isolate.
