A typical VPC subnet
- Input
- 10.0.1.0/24
- Result
- 254 usable hosts, 251 inside a VPC
The network and broadcast addresses are never assignable, and the cloud provider takes three more.
CIDR / Subnet Calculator
Work out what a CIDR block actually contains: network and broadcast addresses, the usable host range, and the smaller count you really get inside a VPC, where the provider keeps five addresses per subnet.
Common blocks
Private range
- Network
- 10.0.0.0/16
- Broadcast
- 10.0.255.255
- First host
- 10.0.0.1
- Last host
- 10.0.255.254
- Netmask
- 255.255.0.0
- Wildcard
- 0.0.255.255
- Total addresses
- 65,536
- Usable hosts
- 65,534
- Usable in a VPC
- 65,531
- Prefix
- /16
AWS, Azure and GCP each reserve five addresses per subnet.
Split into subnets
Runs entirely in your browser. This page is a static file. Whatever you type stays in the tab, is never sent to a server, and is gone when you close it — so pasting a real token or config is safe.
When you reach for this
- Carving a VPC into public and private subnets across availability zones without overlapping ranges.
- Checking whether a
/24still has room before adding another node pool or load balancer. - Writing a security group or firewall rule and needing the exact first and last address of a range.
Worked examples
Splitting a /22 for three availability zones
- Input
- 10.0.0.0/22 split into /24
- Result
- 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24
Four subnets, so one is left spare — usually the right call, because you cannot resize a subnet later.
A point-to-point link
- Input
- 192.168.1.4/31
- Result
- Both addresses are usable
RFC 3021 removed the network/broadcast pair for /31, which is why router links use it.
Where people get this wrong
Forgetting the five reserved addresses
A /28 looks like 14 usable hosts and gives you 11 in AWS. The provider takes the network address, the router, DNS, one for future use, and the broadcast address.
Overlapping CIDRs across VPCs
Two VPCs that both use 10.0.0.0/16 cannot be peered. Allocate non-overlapping ranges up front, because changing one later means rebuilding every subnet in it.
Sizing subnets to today's workload
A subnet's prefix cannot be changed after creation. A /24 that fits now runs out the first time an autoscaler doubles the node count.
Frequently asked questions
Why does AWS give five fewer addresses than the maths says?
In every subnet AWS reserves the network address, the VPC router (.1), the DNS resolver (.2), one address for future use (.3) and the broadcast address. So a /24 yields 251 assignable addresses, not 254.
What is the smallest subnet I can create?
AWS, Azure and GCP accept prefixes from /16 down to /28, giving 11 usable addresses at the smallest. Outside the cloud, /31 is valid for point-to-point links and /32 describes a single host.
Which private ranges should I use?
RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Pick from 10/8 for anything that might grow, keep 192.168/16 for home and lab networks, and avoid 172.17/16 because Docker uses it by default.