CIDR and subnet calculator

Reading the results

Total addresses

Every address in the block: 2 to the power of (32 minus the prefix). A smaller prefix number is a larger network.

Usable (network and broadcast removed)

The usual subnet rule: the first address names the network and the last is the broadcast address.

Usable in an AWS subnet

What you actually get in AWS, after the five reserved addresses below. It is only shown for blocks between /16 and /28.

Private range (RFC 1918)

Whether the block sits inside one of the three private ranges described further down.

How AWS counts addresses

AWS reserves five addresses in every subnet: the first four and the last. In 10.0.1.0/24 that is 10.0.1.0 (network), 10.0.1.1 (VPC router), 10.0.1.2 (DNS), 10.0.1.3 (reserved for future use), and 10.0.1.255 (broadcast, which VPCs do not support). A /24 has 256 addresses and 251 of them are yours.

The VPC block is one pool shared by all of its subnets, and each subnet loses its own five. Sixteen /24 subnets carved from a /20 give 16 × 251 = 4,016 usable addresses, not 4,096. An address belongs to a network interface, so an instance, a database, a load balancer node, or a Fargate task each uses at least one.

Which range should I use?

AWS recommends the three private ranges set aside by RFC 1918. Internet routers do not route them, which is why every network can reuse them. Public address space, by contrast, is assigned to one owner.

• It does not have to be globally unique. Thousands of accounts use 10.0.0.0/16. What matters is that it does not overlap a network you connect to: VPC peering, a VPN to an office, or a Direct Connect gateway all need ranges that do not overlap. Two unconnected VPCs can use the same block.
• A public range is allowed but a bad idea. Inside your VPC those addresses mean your own network, so you could never reach the real hosts that use them.
• Four ranges are refused: 0.0.0.0/8, 127.0.0.0/8 (loopback), 169.254.0.0/16 (link-local), and 224.0.0.0/4 (multicast).
• Avoid the ranges other things already use. 172.31.0.0/16 is the default VPC in each region. 172.17.0.0/16 is Docker's default bridge network, and AWS documents Cloud9 and SageMaker AI using it too.
• Choose the size once. You cannot resize a VPC block or remove the primary one. You can add secondary blocks, including 100.64.0.0/10 shared address space. A /16 leaves room to grow, and a /20 is enough for many small subnets.

A CIDR block names a network, so the host bits must be zero. 11.1.5.100/24 is read as 11.1.5.0/24, and the page tells you when it changed what you typed.