IP Addressing & Subnetting

An IP address (Internet Protocol address) is a numeric label assigned to every device on a network, so it can send and receive data. Think of it like a street address — without it, data has no idea where to go or where it came from.

There are two versions in use today:

• IPv4 — the classic format, written as four numbers separated by dots, e.g. 192.168.1.10. This is what almost all of this guide covers, and what you'll deal with daily on TFhost servers.
• IPv6 — the newer, much larger address space, written in hex groups, e.g. 2001:0db8:85a3::8a2e:0370:7334. Built because IPv4 has "run out" of addresses globally.

An IPv4 address is a 32-bit number, split into four 8-bit sections called octets, separated by dots. Each octet ranges from 0–255, because 8 bits can represent 2⁸ = 256 values (0 through 255).

This is the single most important mental model for subnetting: everything is binary underneath. The decimal dotted format is just a human-friendly way of reading four 8-bit binary blocks.

Private IPs are reserved ranges meant only for use inside local networks (offices, home LANs, internal server VLANs). They are not routable on the public internet.

Public IPs are everything else — globally unique and routable, assigned by your ISP or a regional registry (like AFRINIC for Nigeria). This is the type of IP a hosting server's main network interface typically has, e.g. 160.119.196.135 from your earlier example.

Before CIDR (which you'll use in practice), IPv4 addresses were split into "classes" based on their first octet. Modern networking doesn't strictly follow this anymore, but it's still how a lot of default subnet masks got their historical starting point.

The default gateway is the IP address of the router that a device sends traffic to whenever the destination isn't on its own local subnet — basically, "the door out of this network."

Loopback (127.0.0.1, hostname localhost) always refers to "this machine" — used for testing services locally without touching the network.

A subnet mask tells devices which part of an IP address is the network portion (shared by every device in that subnet) and which part is the host portion (unique to each device).

In binary, a mask is a run of 1s followed by a run of 0s. The 1s mark "network bits," the 0s mark "host bits."

Here, the last octet has 2 bits set to 1 (contributing to network) and 6 bits set to 0 (host bits). Those 6 host bits give you 2⁶ = 64 total addresses in the block — which matches what we calculated for the 160.119.196.135 example earlier.

CIDR (Classless Inter-Domain Routing) notation writes a subnet mask as a slash followed by the number of network bits — e.g. /26 means 26 bits are network bits, leaving 32 − 26 = 6 host bits.

You'll write CIDR constantly — firewall rules, VPS provisioning, WHMCS IP allocations, cloud security groups all use it. 160.119.196.135/26 is the same information as an IP + 255.255.255.192, just more compact.

Every subnet block "reserves" its first and last address:

• Network address — the very first address in the block (all host bits = 0). It identifies the subnet itself, not a device.
• Broadcast address — the very last address in the block (all host bits = 1). Sending a packet here reaches every device on that subnet at once.

Neither can be assigned to a server, router interface, or workstation. That's why usable hosts = block size − 2.

This is the exact process for the question that started this whole page — given an IP and a mask, find the network, broadcast, and usable range.

1. Find the block size from the mask's last non-255, non-0 octet. For 255.255.255.192: 256 − 192 = 64.
2. Find which block the IP falls in by dividing the relevant octet by the block size and rounding down, then multiplying back. For 135: 135 ÷ 64 = 2.1 → block starts at 2 × 64 = 128.
3. Network address = block start → 160.119.196.128
4. Broadcast address = network + block size − 1 → 128 + 64 − 1 = 191 → 160.119.196.191
5. Usable range = network+1 to broadcast−1 → 160.119.196.129 – 160.119.196.190

To convert decimal → binary for one octet, repeatedly check off the largest power of 2 that fits:

To go binary → decimal, just add up the powers of 2 where there's a 1: 128+4+2+1 = 135.

VLSM means you don't have to give every subnet the same size mask. You carve a large address block into subnets of exactly the size each segment needs — a /30 for a router link, a /28 for a small VLAN, a /24 for a big one — instead of wasting a uniform /24 everywhere.

Example: You're given 160.119.196.0/24 and need: a 100-host LAN, a 40-host LAN, a 10-host LAN, and 2 point-to-point router links.

Rule of thumb: allocate biggest subnets first, so smaller ones fit cleanly into the leftover space without fragmenting the block.

Problem 1: IP 41.203.88.50, mask 255.255.255.224 (/27). Find network, broadcast, usable range.

Problem 2: IP 10.10.5.200, mask 255.255.255.240 (/28). Find network, broadcast, usable range.

Problem 3: How many /29 subnets fit inside a /24?

Supernetting is the reverse of subnetting: combining several contiguous smaller networks into one larger route announcement, so routers carry fewer entries in their routing tables.

Example: 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24 can be summarized as a single 192.168.0.0/22 — because those four /24s are contiguous and align on a /22 boundary (a block of 1024 addresses starting at a multiple of 4 in the third octet).

NAT lets a router rewrite the source (or destination) IP of packets as they cross between a private network and the public internet, so many private-IP devices can share one public IP.

• SNAT (Source NAT) — rewrites the outgoing source IP, typically used so an entire office LAN shares one public IP to browse the internet.
• DNAT (Destination NAT / port forwarding) — rewrites the incoming destination IP, used to expose an internal server (e.g. a VPS behind a private subnet) on a specific public IP/port.
• 1:1 NAT — maps one private IP directly to one public IP, common in hosting environments giving each VM its own reachable address.

• Assuming the gateway defines the network address. It doesn't — the mask does. A gateway can legally sit anywhere in the usable range, not just "2nd IP" or "1st IP."
• Forgetting the network/broadcast reservation. Assigning the first or last address of a block to a device will cause routing failures — those two addresses are never usable.
• Mixing up mask and wildcard mask. Some devices (Cisco ACLs) want a wildcard mask, which is the inverse of a subnet mask — e.g. /26's subnet mask is 255.255.255.192, but its wildcard mask is 0.0.0.63.
• Treating VLSM subnets as independent /24s. If you carve a /24 into VLSM chunks, remember the smaller subnets are not separate — they share the parent block's addressing and must not overlap.
• Not double-checking block alignment. A network address must always be an exact multiple of its block size (0, 64, 128, 192 for a /26). If it isn't, the subnet boundary was calculated wrong.