Love it when a vendor sends me a VPN sheet with an invalid subnet on it.

192.168.3.18/30

This is not a thing that can exist due to the way binary works! It just can’t!

What it should be is: 192.168.3.16/30. That leaves two free IPs in the range as a /30 is really tiny.

The reason is that in binary for a /30, the first 30 bits are masked out, like so:

nnnnnnnn.nnnnnnnn.nnnnnnnn.nnnnnnhh

Leaving the last two bits as valid for hosts on that subnet. Two bits in binary: four possible combos (two to the second power, the first IP in the range is the subnet ID and the last is the broadcast address). Tada!

(Note that this is only a partial, non-exhaustive explanation, and omits very many necessary details required for a full understanding.)