Subnet masks, when represented as a row of 32 bits (1s or 0s), always have all 1s on the left (the most significant bits of the first octets), and all 0s on the right (the least significant bits of the last octets). So we can describe them in shorthand by just noting how many 1's there are.

As you know, a /21 has 21 1's, starting from the left:

11111111.11111111.11111000.00000000

Now convert each octet to decimal to get the familiar "dotted-decimal" or "dotted-quad" notation:

255.255.248.0

This is because the most significant bit in an octet (8-bit Byte) is the "128's place", the next is the "64's place", etc:

128, 64, 32, 16, 8, 4, 2, 1

So in that third octet, you have 5 1s and 3 0's:

128 + 64 + 32 + 16 + 8 + 0 + 0 + 0 = 248

Now let's look at your /23:

11111111.11111111.11111110.00000000

That third octet converts to decimal like this:

128 + 64 + 32 + 16 + 8 + 4 + 2 + 0 = 254

255.255.254.0

You see, by adding two bits to the subnet mask, you're not adding a "binary 2" (the value 2, which is 10 in binary), or even the max value two bits can store (binary 11 = decimal 3).

You've got to look at the binary place-value of the 1s you're adding to the mask. In your case, you were adding a 1 in the 4's place, and a 1 in the 2's place, so you're adding 6 to that octet's value.

248 + 6 = 254

Because of the way that subnet masks "grow from the left" like this, there are only 9 possible values for any octet in a subnet mask:

  0 +  0 +  0 +  0 + 0 + 0 + 0 + 0 =   0
128 +  0 +  0 +  0 + 0 + 0 + 0 + 0 = 128
128 + 64 +  0 +  0 + 0 + 0 + 0 + 0 = 192
128 + 64 + 32 +  0 + 0 + 0 + 0 + 0 = 224
128 + 64 + 32 + 16 + 0 + 0 + 0 + 0 = 240
128 + 64 + 32 + 16 + 8 + 0 + 0 + 0 = 248
128 + 64 + 32 + 16 + 8 + 4 + 0 + 0 = 252
128 + 64 + 32 + 16 + 8 + 4 + 2 + 0 = 254
128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255

/16, /24 is called CIDR notation, it's a different way to express the subnet mask.

A subnet mask can be used for any IP, public, private, etc.; the /X has nothing do really whether the IP is public or private.

Electronic equipment processes IP addresses as a string of 32 bits that can either be 1 or 0. It only cares about the 1's and 0's; writing it as decimal numbers is for our benefit, not any router, computer, phone, etc.

The 4 decimal numbers in an IPv4 is just a shorter way to write them so we don't have to write all the 0's and 1's.

The way the 4 decimal numbers relate to those 0's or 1's is like the below. Wherever there is a 1, add that number to that set of 8 bits to get the decimal number for that "octet".

1                 1                 1                 1               
2 6 3 1           2 6 3 1           2 6 3 1           2 6 3 1         
8 4 2 6 8 4 2 1 . 8 4 2 6 8 4 2 1 . 8 4 2 6 8 4 2 1 . 8 4 2 6 8 4 2 1    

--------------- . --------------- . --------------- . ---------------

1 1 0 0 0 0 0 0   1 0 1 0 1 0 0 0   0 0 0 0 0 0 0 0   0 0 0 0 0 1 0 1

--------------- . --------------- . --------------- . ---------------

192             . 168             . 0               . 5

Net masks are always a long string of 1's followed by a long string of 0's. It determines what part of the IP identifies the network (the 1's) and what part identifies the computer/phone/host/etc.

That works like this:

1                 1                 1                 1               
2 6 3 1           2 6 3 1           2 6 3 1           2 6 3 1         
8 4 2 6 8 4 2 1 . 8 4 2 6 8 4 2 1 . 8 4 2 6 8 4 2 1 . 8 4 2 6 8 4 2 1 

--------------- . --------------- . --------------- . ---------------

1 1 1 1 1 1 1 1 . 1 1 1 1 1 1 1 1 . 1 1 1 1 1 1 1 1 . 0 0 0 0 0 0 0 0

--------------- . --------------- . --------------- . ---------------

255             . 255             . 255             . 0

                      1 1 1 1 1 1   1 1 1 1 2 2 2 2   2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7   8 9 0 1 2 3 4 5   6 7 8 9 0 1 2 3   4 5 6 7 8 9 0 1

--------------- . --------------- . --------------- . ---------------

_ _ _ _ _ _ _ _   _ _ _ _ _ _ _ _   _ _ _ _ _ _ _ _   *

or /24

CIDR just says we can simply say the number of 1 bits without writing out the four decimal numbers of the subnet mask. So you can write 192.168.0.5/24 instead of 192.168.0.5/255.255.255.0.

Thanks to @MrShunz and @chili555 in the comments. These are the settings that worked for me: Subnet: 192.168.1.0/24 Address: 192.168.1.101 Gateway: 192.168.1.1 Name servers: 8.8.8.8