What is CIDR notation (e.g. 10.0.0.0/24)?

Short answer

CIDR notation (RFC 4632) writes an address block as its starting address together with the bit length of the network part (prefix), in the /n form: 10.0.0.0/24 describes the block whose first 24 bits are the network part and which contains 256 addresses; /32 is a single IPv4 address, /128 a single IPv6 address. In TR7, in the Add IP form, the CIDR value of the Interface IP row is 24 by default (0–32 for IPv4, 0–128 for IPv6); in the VIP row, the box comes as auto, and if it is left empty or 0 is entered, /32 is assigned in IPv4 and /128 in IPv6. The Destination Network field of a static route is also written with CIDR (default 24), and in the record the address is converted to the starting address of the block (e.g. 203.0.113.77/24 → 203.0.113.0/24). In Firewall rules, in the DDoS Whitelist and in the IP lists of Load Balancer, a CIDR block can also be entered instead of a single address.

Where It Is Used in TR7

Where	Field / label	What for
Network → Interfaces → Add IP	The CIDR column (24 by default in Interface IP; auto in VIP)	The length of the subnet the address belongs to
Network → Interfaces → Add Route	Destination Network (address + CIDR box, default 24)	The destination block covered by the route
Network → Firewall → Add	Source and Destination IP → Manual	Applying the rule to a single address or to a block
The L4 DDoS Management screen of the route table	DDoS Whitelist → an entry of the Network type	Exempting a block from the L4 DDoS measures
Load Balancer actions → Ip Log Masking	Masking(subnet)	Masking the client IP according to the given prefix length
WEB-CLI	sys-cmd ipcalc (ipcalc)	Calculating the network address, the broadcast address and the address range of a CIDR block

• Blocking specific IPs and CIDRs in Load Balancer or allowing only them: Can I block specific IPs/CIDRs or allow only them?

Commonly Used Prefixes

Prefix	Number of IPv4 addresses	Example
/32	1	A single address (192.0.2.10/32)
/24	256	192.0.2.0 – 192.0.2.255
/16	65,536	172.16.0.0 – 172.16.255.255
/0	All addresses	0.0.0.0/0 (default route)

The same logic applies in IPv6 too: /64 is a typical IPv6 subnet, and ::/0 is the IPv6 default route.

Common Misconceptions

• "Writing 203.0.113.77/24 selects only that address." /24 covers the entire block; in Destination Network, this value is saved as 203.0.113.0/24. For a single address, /32 (/128 in IPv6) is used.
• "The CIDR of the VIP must be entered the same as that of the Interface IP." In the VIP row, CIDR can be left empty; TR7 assigns /32 in IPv4 and /128 in IPv6; the same value is also assigned if 0 is entered. A value of 1 or more is used as it is.
• "The CIDR of the Interface IP is unimportant." CIDR determines which subnet the address is in; in a cluster, whether the addresses of the two devices are in the same subnet and which IP the default gateway matches are validated according to this value (What is a subnet; why does TR7 require the same subnet?).

How it is done in the documentation

• Add IP Address · IP
• Add Static Routing · Destination Network
• Firewall · Manual
• WEB-CLI · sys-cmd ipcalc

Related questions

• Can I block specific IPs/CIDRs or allow only them?
• What is a subnet; why does TR7 require the same subnet?
• What is the difference between IPv4 and IPv6?