/25 subnet: mask 255.255.255.128, 126 usable hosts

The /25 mask

The 25th bit is the top bit of the last octet, so the mask is 255.255.255.128 and the wildcard 0.0.0.127. That single bit picks the lower half (.0–.127) or the upper half (.128–.255).

2^7 = 128 addresses, 126 usable. In 10.0.0.0/25 hosts go from 10.0.0.1 to 10.0.0.126, and the broadcast is 10.0.0.127. The upper half, 10.0.0.128/25, has network .128 and broadcast .255.

When to split a /24 in two

A /25 pair is the minimum segmentation of an existing /24: servers on one half, clients on the other, or production and staging side by side, each with its own gateway and ACLs. It costs two more unusable addresses than the single /24.

In the cloud, a /25 subnet offers 123 assignable addresses after the five reserved per subnet on AWS and Azure, comfortable for a tier of virtual machines that will never autoscale into the hundreds.

Common mistakes

The gateway for the upper half is often configured as .1 out of habit, which sits in the lower half and is unreachable on-link. In 10.0.0.128/25 the first usable address is .129.

Smaller still, a /26 quarters the /24; larger, two /25s rejoin as the original /24.

Configuring both halves

The lower half takes a gateway such as 10.0.0.1 and a DHCP scope ending at 10.0.0.126; the upper half needs its own gateway at .129 and its own scope. Each half needs its own VLAN or router interface: two /25s on one switch segment with no router between them gain nothing over the original /24.

Firewall rules that referred to the full /24 still match both halves, which is convenient during a migration but means the split adds no isolation until those rules are rewritten per /25.

Plan the split around the gateway you already have. If the existing router sits at .1 it stays in the lower /25, so the upper half is the one that gets a new gateway address and a DHCP change, and its hosts are the ones that move.