0.0.0.0/0 — the route that matches everything
0.0.0.0/0 is the entire IPv4 Internet expressed as a prefix: zero network bits, so every one of the 4,294,967,296 possible addresses matches it. You will never assign it to a host, but you see it constantly — it is how routing tables say "everything else".
Confusingly, the bare address 0.0.0.0 means three different things depending on context: the default route in a routing table, an "unspecified" source address during bootstrapping, and "all local interfaces" as a bind address. The /0 suffix pins it to the routing meaning.
| Range start | 0.0.0.0 |
| Range end | 255.255.255.255 |
| Subnet mask | 0.0.0.0 |
| Wildcard mask | 255.255.255.255 |
| Total addresses | 4,294,967,296 |
0.0.0.0/0 spans the whole IPv4 space, so "network", "broadcast" and "usable hosts" do not apply — these are the mathematical boundaries of the range itself.
The default route and your default gateway
Routers pick the most specific matching prefix for every packet. A host's routing table usually has one route for its local subnet and one route — 0.0.0.0/0 via the "default gateway" — that catches everything else. When your laptop sends a packet to a public address, no local route matches, so the packet goes to the gateway, which repeats the process upstream.
That is also why 0.0.0.0/0 shows up in VPN configs: a client that installs it (often as two /1s, 0.0.0.0/1 and 128.0.0.0/1, to outrank the existing default) routes all of your traffic through the tunnel.
0.0.0.0 as "this host, unspecified"
Per RFC 1122, a host that does not know its own address yet may use 0.0.0.0 as a source — DHCP Discover is the everyday example: a fresh machine broadcasts from 0.0.0.0:68 to 255.255.255.255:67 asking for a lease. In this role the address is never a destination and never routed; it is a placeholder for "me, whoever I am".
The 0.0.0.0 bind footgun
When a server "listens on 0.0.0.0", it accepts connections on every interface the machine has — LAN, WAN, that VPN tunnel you forgot about. Developers bind it to make a dev server reachable from other devices, then accidentally expose the service to the whole network. If the service is meant for local use only, bind 127.0.0.1 instead; the difference is the gap between "my machine" and "anyone who can reach my machine".
CIDR Calculator
Run the math on 0.0.0.0/0 — or any other block
Frequently asked questions
What does 0.0.0.0/0 mean?
It is the default route: a prefix with zero network bits that matches every IPv4 address. In a routing table it means "send everything that has no more specific route to this next hop" — usually your default gateway.
Is 0.0.0.0 a valid IP address?
Not for identifying a host. It is valid in three special roles: as a routing-table catch-all, as a source address before a host has one (DHCP), and as a bind address meaning "all interfaces".
Should I allow 0.0.0.0/0 in a firewall rule?
As a source it means "anywhere on the Internet" — fine for a public web server's inbound 443, reckless for SSH or databases. As a destination it simply permits outbound traffic to go anywhere.
What is the difference between 0.0.0.0 and 127.0.0.1?
0.0.0.0 means "unspecified" or "all interfaces"; 127.0.0.1 is the loopback address that only ever refers to the local machine. Binding 0.0.0.0 exposes a service to the network; binding 127.0.0.1 keeps it on the host.