/29 subnet: mask 255.255.255.248, 6 usable hosts

The /29 mask

Three host bits remain: mask 255.255.255.248, wildcard 0.0.0.7. Networks begin at multiples of 8 in the last octet.

2^3 = 8 addresses, 6 usable. In 10.0.0.0/29 hosts are 10.0.0.1 to 10.0.0.6 and the broadcast is 10.0.0.7.

Static IPs from an ISP

Business connections with "five usable static IPs" are usually a /29: six usable host addresses, one of which is the ISP's gateway, leaves five for your firewall, servers or NAT pool. Read the provider's handover sheet carefully; some routed /29s arrive over a separate /30 or /31 link and then all six are yours.

In the cloud, Azure and Google Cloud both accept /29 as their minimum subnet. Azure reserves five addresses, leaving 3; Google Cloud reserves four, leaving 4. AWS does not allow subnets smaller than /28 at all.

Splitting and neighbours

A /29 splits into two /30s, and two aligned /29s form a /28. For a single router-to-router link, a /30 or /31 wastes less.

Configuring a /29

A typical handover is 10.0.0.0/29 with the provider's router on 10.0.0.1 or 10.0.0.6 and your firewall on the next address. The mask on your side must be 255.255.255.248; a firewall configured as /24 will ARP for addresses that are not on the link and fail in confusing ways.

To put more than one device on the public side, connect them through a switch on the /29 segment, or route the block behind the firewall and use proxy ARP or one-to-one NAT, depending on what the provider supports.

Ask the provider whether the block is on-link or routed to you. On-link means every address must answer ARP on the WAN segment; routed means the provider sends the whole /29 to one next hop, and your firewall can place the addresses wherever it likes.