/27 subnet: mask 255.255.255.224, 30 usable hosts

The /27 mask

Three host-octet bits move to the network side: mask 255.255.255.224, wildcard 0.0.0.31. The last octet of a /27 network is always 0, 32, 64, 96, 128, 160, 192 or 224.

2^5 = 32 addresses, 30 usable. For 10.0.0.0/27 the usable range is 10.0.0.1 to 10.0.0.30 and the broadcast 10.0.0.31.

Where /27 is common

Thirty hosts covers a DMZ, a VPN client pool, a printer and camera VLAN, or a small set of public addresses from a hosting provider. Providers that sell IPv4 blocks often quote /27 and /28 as their smallest routed allocations.

On AWS a /27 subnet keeps 27 usable addresses after the five reserved. That shrinkage matters more the smaller the subnet: here it is about one address in six.

Neighbours

A /27 splits into two /28s; two aligned /27s make a /26. If you only need a handful of addresses, a /28 or a /29 wastes less; if a service may grow past thirty instances, start at /26.

Configuring a /27

In 10.0.0.0/27, give the gateway 10.0.0.1 and keep hosts at or below 10.0.0.30. The broadcast 10.0.0.31 and the next block's network address, 10.0.0.32, are the two addresses people most often assign by mistake.

Vendor forms without a prefix field ask for the dotted mask, 255.255.255.224. Writing both forms side by side in the runbook saves the on-call engineer a conversion under pressure.

If the /27 holds public addresses from a provider, confirm whether the provider's gateway sits inside it. When it does, one more address is gone and 29 remain for your own equipment.

Reverse DNS for such a block is usually delegated by the provider, since a /27 does not align to an octet; ask for classless delegation if you need to manage the PTR records yourself.