When would I use a /32 in a firewall rule?

When you want to allow or deny traffic from exactly one specific IP address rather than a range - for example, allowlisting a single office's public IP for SSH access.

Is a /32 the same as a host route?

Yes - a /32 route in a routing table is commonly called a host route because it directs traffic to one specific host address rather than an entire subnet.

Networking

Published March 26, 20266 min read

What Does /32 Mean in CIDR?

A /32 is the smallest possible CIDR block - exactly one address, with no network or broadcast concept at all.

A /32 is the smallest possible CIDR block: it identifies exactly one IPv4 address, with zero bits left over for a range of hosts.

The direct answer

192.168.1.100/32 refers to exactly one address - 192.168.1.100 - and nothing else. There's no network address, no broadcast address, and no usable host range, because all 32 bits of the address are fixed. It's a single point, not a range.

Why this differs from every other prefix

Prefix	Host bits	Total addresses	Has network/broadcast?
/30	2	4	Yes
/31	1	2	No (RFC 3021 - both usable)
/32	0	1	No - it's a single address

Where /32 shows up in practice

Host routes - a routing table entry that directs traffic to one exact address, rather than an entire subnet
Firewall allowlists - restricting access to a specific known IP (e.g., an office's public address or a monitoring service)
Cloud security group rules - scoping an ingress rule to exactly one source address
DNS and load balancer configuration - sometimes used to reference a single backend address explicitly

A practical example

Suppose you want to allow SSH access to a server only from your office's static IP, 203.0.113.42. The firewall rule would specify 203.0.113.42/32 - explicitly one address, rather than a broader range like 203.0.113.0/24 that would include every address on that block.

# Example firewall rule allowing SSH from exactly one address
allow tcp/22 from 203.0.113.42/32

Common mistakes

Forgetting the /32 entirely and writing just the bare IP in a context that expects CIDR notation - some tools will reject this or interpret it unexpectedly.
Using a /32 when you actually meant to allow a small range (like a /29) of related addresses.
Assuming a /32 has a "network address" or "broadcast address" the way larger subnets do - it doesn't; the single address is both, and neither, at once.

For the general math behind CIDR sizing, see CIDR Notation Explained and How to Calculate the Number of IP Addresses in a CIDR Block.

Summary

A /32 is as specific as CIDR notation gets - exactly one address, used whenever a rule, route, or allowlist needs to reference a single host rather than a range.

Frequently asked questions

What does /32 mean in CIDR?: A /32 means all 32 bits of the address are fixed as the network portion, leaving zero host bits - so the block contains exactly one address, with no separate network or broadcast address.
When would I use a /32 in a firewall rule?: When you want to allow or deny traffic from exactly one specific IP address rather than a range - for example, allowlisting a single office's public IP for SSH access.
Is a /32 the same as a host route?: Yes - a /32 route in a routing table is commonly called a host route because it directs traffic to one specific host address rather than an entire subnet.

#cidr #ipv4 #networking