CIDR / Subnet Calculator

What is CIDR notation?

CIDR (Classless Inter-Domain Routing) writes an IP block as an address followed by a slash and a prefix length: 10.0.0.0/16. The prefix says how many of the 32 bits of an IPv4 address are fixed and identify the network; the remaining bits are free and identify hosts inside it. A /16 fixes the first 16 bits (the 10.0), leaving 16 host bits, so the block holds 2¹⁶ = 65,536 addresses from 10.0.0.0 to 10.0.255.255. Each extra prefix bit halves the block: a /17 has 32,768 addresses, a /24 has 256.

The same prefix can be written as a netmask, a 32-bit value with ones for network bits: /16 is 255.255.0.0, /26 is 255.255.255.192. The wildcard mask is the inverse (0.0.255.255) and is used by Cisco ACLs and some firewall rules. ANDing any address with the netmask gives the network address; setting all host bits to one gives the broadcast address. Traditionally those two are not assigned to hosts, so a block has 2^{host bits} − 2 usable addresses (except /31 point-to-point links, which use both, and /32 single hosts).

Prefix reference table

The 5 addresses AWS reserves in every subnet

In an Amazon VPC, the first four addresses and the last address of every subnet cannot be assigned to instances, load balancers or ENIs. For a subnet 10.0.0.0/24:

• 10.0.0.0: network address.
• 10.0.0.1: reserved for the VPC router.
• 10.0.0.2: reserved for the Amazon-provided DNS server (for the VPC's primary CIDR it is the base of the VPC range plus two; AWS reserves it in every subnet).
• 10.0.0.3: reserved by AWS for future use.
• 10.0.0.255: network broadcast address. VPCs do not support broadcast, but the address is still reserved.

So a /24 gives you 251 usable addresses, and the smallest allowed subnet, a /28, gives only 11. AWS allows VPC and subnet IPv4 blocks between /16 (65,536 addresses) and /28 (16 addresses). Plan generously: EKS pods, Lambda functions in a VPC, interface endpoints and load balancers all consume subnet IPs, and you cannot resize a subnet after creating it.

Private address ranges (RFC 1918) and other special blocks

Three ranges are reserved for private networks and are never routed on the public internet. They are the right choice for a VPC, a home LAN or an office network:

• 10.0.0.0/8: 10.0.0.0 – 10.255.255.255 (16.7 million addresses)
• 172.16.0.0/12: 172.16.0.0 – 172.31.255.255 (1 million). AWS default VPCs use 172.31.0.0/16; Docker's default bridge uses 172.17.0.0/16, so avoid that one for VPCs that run Docker hosts or that you reach from developer laptops.
• 192.168.0.0/16: 192.168.0.0 – 192.168.255.255 (65,536). Very common on home routers, so it often collides with VPN users.

Other blocks you will meet: 100.64.0.0/10 (carrier-grade NAT, RFC 6598, which AWS also allows as a secondary VPC range), 127.0.0.0/8 (loopback), 169.254.0.0/16 (link-local; the EC2 instance metadata service lives at 169.254.169.254), 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 (documentation examples), and 224.0.0.0/4 (multicast).

Planning a VPC: a worked example

A common production layout uses one VPC per environment and one public and one private subnet in each of three availability zones:

1. Pick a VPC block that won't collide. Give each VPC and each on-premises network its own non-overlapping range (for example 10.0.0.0/16 for prod, 10.1.0.0/16 for staging, 10.2.0.0/16 for dev) so that VPC peering, Transit Gateway and VPN connections remain possible later. Peered VPCs cannot have overlapping CIDRs.
2. Split it. Splitting 10.0.0.0/16 into /20s gives 16 subnets of 4,091 usable AWS addresses each. Use six of them (public-a, public-b, public-c, private-a, private-b, private-c) and keep the rest spare for databases, new AZs or future needs. Use the splitter above with "3 AZs · public + private" to see the exact ranges.
3. Size private subnets for growth. Public subnets usually hold only load balancers and NAT gateways, so they can be smaller. Private subnets host instances, containers and pods, which is where addresses run out.
4. Leave room. You can add secondary CIDR blocks to a VPC later, but you can never change an existing subnet's size, so unallocated space is cheap insurance.

Classful addressing

Before CIDR (1993), the first bits of an address fixed its size: class A (0–127, /8), class B (128–191, /16), class C (192–223, /24), with class D for multicast and E reserved. Classes are obsolete for routing, but the terms are still used informally, so this calculator shows the class for reference.