CIDR range examples
When you create a subnet you specify a CIDR block that is a subset of the VPC CIDR block. For IPv4 you cannot create a subnet with a CIDR block larger than a /16.
CIDR rules for AWS VPCs
Section titled “CIDR rules for AWS VPCs”- Minimum VPC or subnet size: /28 (16 addresses)
- Maximum VPC or subnet size: /16 (65,536 addresses)
- The primary CIDR block should come from the RFC 1918 private ranges:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- An Amazon-provided IPv6 CIDR block for a VPC is a /56.
- Subnet IPv6 CIDR blocks are conventionally /64.
Prefix length reference
Section titled “Prefix length reference”| CIDR | Netmask | Calculation | Addresses | Typical use |
|---|---|---|---|---|
| /32 | 255.255.255.255 | 2^(32-32) = 2^0 | 1 | Single host address (for example, a firewall rule) |
| /31 | 255.255.255.254 | 2^(32-31) = 2^1 | 2 | Point-to-point links between routers |
| /30 | 255.255.255.252 | 2^(32-30) = 2^2 | 4 | Router-to-router WAN links |
| /29 | 255.255.255.248 | 2^(32-29) = 2^3 | 8 | Very small office networks, IoT segments |
| /28 | 255.255.255.240 | 2^(32-28) = 2^4 | 16 | Smallest permitted AWS subnet |
| /27 | 255.255.255.224 | 2^(32-27) = 2^5 | 32 | Small department networks |
| /26 | 255.255.255.192 | 2^(32-26) = 2^6 | 64 | Medium department networks |
| /25 | 255.255.255.128 | 2^(32-25) = 2^7 | 128 | Large department networks |
| /24 | 255.255.255.0 | 2^(32-24) = 2^8 | 256 | Standard enterprise subnet |
| /23 | 255.255.254.0 | 2^(32-23) = 2^9 | 512 | Large subnet spanning departments |
| /22 | 255.255.252.0 | 2^(32-22) = 2^10 | 1,024 | Campus networks, data centre segments |
| /21 | 255.255.248.0 | 2^(32-21) = 2^11 | 2,048 | Small ISP allocations |
| /20 | 255.255.240.0 | 2^(32-20) = 2^12 | 4,096 | Medium ISP allocations |
| /19 | 255.255.224.0 | 2^(32-19) = 2^13 | 8,192 | Large ISP allocations |
| /18 | 255.255.192.0 | 2^(32-18) = 2^14 | 16,384 | Regional ISP networks |
| /17 | 255.255.128.0 | 2^(32-17) = 2^15 | 32,768 | Large regional networks |
| /16 | 255.255.0.0 | 2^(32-16) = 2^16 | 65,536 | Largest permitted AWS VPC or subnet |
| /8 | 255.0.0.0 | 2^(32-8) = 2^24 | 16,777,216 | Largest organisations, legacy Class A |
| /0 | 0.0.0.0 | 2^(32-0) = 2^32 | 4,294,967,296 | The entire IPv4 address space |
Worked examples
Section titled “Worked examples”Usable address counts. On a conventional network two addresses per subnet are unusable (network and broadcast); in a VPC subnet AWS reserves five.
- /24 = 256 addresses, 254 usable on a conventional network, 251 in a VPC subnet
- /28 = 16 addresses, 14 usable, 11 in a VPC subnet
- /27 = 32 addresses, 30 usable, 27 in a VPC subnet
- /16 = 65,536 addresses, 65,534 usable, 65,531 in a VPC subnet
Given a VPC of 10.0.0.0/16:
- The largest possible subnet is a /16, the same size as the VPC.
- 10.0.1.0/24 is a valid subnet.
- 11.0.0.0/24 is not valid — it falls outside the VPC CIDR block.
For 192.168.1.0/24 on a conventional network:
- First usable address: 192.168.1.1
- Last usable address: 192.168.1.254
- Broadcast address: 192.168.1.255
Overlap:
- 10.0.0.0/24 and 10.0.0.128/25 overlap — the second is contained in the first.
- 10.0.0.0/24 and 10.0.1.0/24 do not overlap.
Splitting 10.0.0.0/24 into four equal subnets gives 10.0.0.0/26, 10.0.0.64/26, 10.0.0.128/26 and 10.0.0.192/26.