Network core

Read the routing table before touching anything else — most "network is broken" reports are a routing or DNS problem wearing a different costume.

Subnetting and CIDR — quick judgment

CIDR notation is prefix length, not a mask to memorize per case: /24 = 256 addresses (254 usable), /25 = 128 (126 usable), /29 = 8 (6 usable) — the host count halves each time the prefix grows by one bit
Conventional IPv4 multi-access subnets reserve network and broadcast addresses. /31 point-to-point links and /32 host routes are exceptions; IPv6 has different addressing rules and no broadcast address.
size a subnet to the actual host count plus growth headroom, not a round number out of habit — a /24 for a 5-host VLAN wastes 250 addresses and widens the broadcast domain for no reason
overlapping subnets across a VPN/tunnel is the single most common "why can't I reach X" bug — check both sides' CIDR ranges before anything else when a tunnel is involved

ip route (Linux) / route print (Windows) — read for longest-prefix match: the most specific matching route wins, not the first one listed
traffic with no matching entry falls to the default route (0.0.0.0/0 / ::/0) — missing or wrong, and everything off-subnet breaks
a VPN pushing 0.0.0.0/0 silently rewrites the default route through the tunnel — check ip route after bringing up any VPN client rather than assuming only tunnel-destined traffic changed
policy/split routing (route by source, not just destination) is how one host reaches two networks through two different gateways at once — see references/tunnels.md for the tunnel-specific pattern