What is a CIDR block in plain English?

A CIDR block is shorthand for a group of IP addresses, written as an address plus a slash and a number, like 203.0.113.0/24. The number after the slash says how much of the address is fixed and the rest is a wildcard. A /24 fixes the first three numbers and lets the last vary, which is 256 addresses; a /32 is a single address. A smaller number after the slash means a bigger block.

What's the difference between an IP range and a CIDR block?

A range is an explicit start and end address with everything in between, such as 203.0.113.10 to 203.0.113.20. A CIDR block describes a group that follows a common pattern using slash notation, such as 203.0.113.0/24. Both are ways to allow more than one address at once; a good time clock accepts single IPs, ranges, and CIDR blocks.

Which IP does an office time clock lock to — the one on my computer?

It locks to your public IP, not the private internal address (like 192.168.x) your router assigns inside the building. Everyone on your office network shares the same public IP when they connect out, and a device on someone's home Wi-Fi can't use it — which is why it works as a proxy for being physically on-site. A 'Use this IP' helper shows the public address you're connecting from so you can capture it easily.

Do I need to understand CIDR to use an IP-locked time clock?

No. In most cases your internet provider or IT person hands you the exact CIDR block or range, and a one-click helper can capture your office's public IP for you. Understanding the notation just helps you recognize what you're pasting in and set allowlists at the company, office, or per-employee level.

CIDR and IP Ranges, Explained for Non-Techies

You opened a settings screen — probably on a time clock or a security tool — and it asked you to enter an “IP address, CIDR block, or range.” If your reaction was I just want to lock clock-in to my office, why am I looking at 203.0.113.0/24?, this is for you. CIDR and IP ranges sound like network-engineer territory, but the idea underneath is simple, and you only need to understand it once.

This is a plain-English explainer: what an IP address actually is, what a “range” and a “CIDR block” mean, and why an office time clock like Punchwell’s office-IP clock-in lock lets you enter all three. No prior networking knowledge assumed.

First, what an IP address is

Every device on the internet has an address so replies know where to come back to. For the most common kind (IPv4), an address is four numbers from 0 to 255, separated by dots:

203.0.113.42

Think of it like a street address for a connection. When your office computer talks to a website, it does so from an address like that.

Here’s the important twist for a time clock: there are two kinds of address in play.

Private (internal) addresses — the ones your router hands out inside your building, like 192.168.1.5 or 10.0.0.20. Every office has these, and they’re not unique to you; millions of networks reuse the same private ranges. These are not what a time clock locks to.
Your public address — the single address the outside world sees when anyone in your office connects out. Everyone sharing your office Wi-Fi and wired network goes out through the same public IP. This is what an office lock uses.

That last point is the whole trick. Because your public IP is shared by everyone physically on your office network — and can’t be borrowed by a device sitting on someone’s home Wi-Fi — “did this punch come from our public IP?” is a good proxy for “is this person actually in the building?”

Why one address often isn’t enough

If your office had exactly one public IP that never changed, you’d just type it in and be done. Real networks are messier:

A larger business might be assigned a block of public addresses, not a single one.
A site with more than one internet connection (a primary and a backup line) can appear from more than one address.
Multiple offices each have their own public IP.

So instead of forcing you to list addresses one at a time, good tools let you describe a whole group at once. That’s what ranges and CIDR are for.

IP ranges, in plain terms

A range is exactly what it sounds like: a start address and an end address, with everything in between included.

203.0.113.10 to 203.0.113.20

That allows those eleven addresses and nothing else. Ranges are the most human-readable way to say “any of these.” If your provider told you “your addresses run from X to Y,” you can type it in exactly like that.

CIDR blocks, decoded

CIDR (say it “cider”) is just a compact shorthand for a block of addresses that follows a common pattern. It looks like an IP address with a slash and a number after it:

203.0.113.0/24

Read it like this: the number after the slash says how much of the address is fixed, and everything else is a wildcard.

/24 fixes the first three numbers (203.0.113.) and lets the last one be anything from 0 to 255 — that’s 256 addresses, 203.0.113.0 through 203.0.113.255. This is the everyday one most small offices use.
/32 fixes all four numbers — that’s a single address. So 203.0.113.42/32 is just one specific IP.
/16 fixes only the first two numbers and lets the last two vary — that’s 65,536 addresses, a big block.

The counterintuitive part: a smaller number after the slash means a bigger block. /24 is bigger than /32; /16 is bigger than /24. You don’t need to memorize the math — you’ll usually be handed the exact CIDR by your internet provider or IT person and just paste it in. But now you know what it’s saying: “allow this whole neighborhood of addresses.”

What about IPv6? Newer networks use a longer address format (IPv6), which looks like 2001:db8::/32. Same idea — an address plus an optional /number block — just longer. A capable time clock accepts both IPv4 and IPv6, so you enter whichever your network uses.

Why a time clock wants ranges, not just one address

When the goal is “only let staff clock in from our office network,” being able to enter a single IP, a CIDR block, or a range isn’t a nice-to-have — it’s what makes the lock survive real-world networks. Punchwell’s office-IP lock accepts all three (IPv4 and IPv6), and adds two things worth knowing:

A one-click “Use this IP” helper. On every address-entry screen, it shows the public IP you’re connecting from right now, so you can capture your office address without hunting for it. Do it from inside the office and you’ve got the right value.
Three allowlist levels that combine. You can set allowed addresses company-wide, per office, and per individual employee — and the levels are unioned, meaning adding an address only ever widens who can punch, never narrows it. So a company-wide block covers everyone, a per-office block adds a second site, and a per-employee entry lets one remote person clock in from home — without disturbing anyone else.

That per-employee and per-office depth is rarer than you’d think. The closest WordPress competitor, WP ERP, offers an IP whitelist too, but it’s global-only — one list for everyone, all-or-nothing (approximate, as of June 2026 — confirm current capabilities). Being able to allow a whole /24 for the shop floor while carving out a single /32 for the traveling manager is the difference between a lock you can actually live with and one you turn off the first time it’s inconvenient.

Ranges and CIDR are also why the lock pairs cleanly with softer options when a site has no fixed address — a GPS geofence, kiosk, or mobile punch screen can cover the cases where a network-level lock isn’t the right tool.

The one-paragraph summary

An IP address is a connection’s address. Your public IP is the single one everyone in your office shares, and it’s what an office lock keys on. A range lists a start and end address; a CIDR block like 203.0.113.0/24 is shorthand for a group, where the number after the slash says how much is fixed (bigger block = smaller number). You’ll usually be handed the exact value by your provider — you just need to recognize it and paste it in.

If you’d like to see how the allowlist, the “Use this IP” helper, and the three combining levels fit together in practice, the features hub is the calm place to look next.

Punchwell is an independent, third-party maintained fork of the GPL-licensed “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. WP ERP is referenced descriptively only; all trademarks belong to their respective owners. Competitor capabilities are approximate, as of June 2026 — confirm current details before relying on them.

Punchwell is an independently maintained GPL fork. Not affiliated with the original “WP Human Resource Management” plugin or its authors. Competitor names and figures are nominative and approximate (as of the date noted) — confirm current rates.