Private IPv4 address planning
Three IPv4 ranges are reserved by RFC 1918 for private use. They are not routable on the public internet, and every organisation is free to use them internally.
| Range | Addresses | Size | Conventional class |
|---|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 – 10.255.255.255 | 16,777,216 | One Class A network |
| 172.16.0.0/12 | 172.16.0.0 – 172.31.255.255 | 1,048,576 | 16 Class B networks |
| 192.168.0.0/16 | 192.168.0.0 – 192.168.255.255 | 65,536 | 256 Class C networks |
Read 10.0.0.0/8 as “network 10.0.0.0 with an 8-bit prefix”, equivalently a 255.0.0.0 netmask.
Choosing a range
Section titled “Choosing a range”- 10.0.0.0/8 for anything that will grow. It gives the most room to carve out one non-overlapping block per account, environment and Region, which is what makes later VPC peering and transit gateway work possible.
- 172.16.0.0/12 for mid-sized estates, or when 10/8 is already spoken for by an on-premises network.
- 192.168.0.0/16 for home and small office networks. It is the range consumer routers use, which makes it a poor choice for a VPC that will ever connect to a home or branch office over VPN.
Two other ranges are reserved rather than private: 127.0.0.0/8 for loopback, and 169.254.0.0/16 for link-local addresses, which AWS uses for the instance metadata service and for VPN tunnel inside addresses.
Overlap only matters when networks meet
Section titled “Overlap only matters when networks meet”Two organisations can both use 10.0.0.0/16 internally with no consequence, because neither range is visible to the other. The same is true of two VPCs that never connect.
Overlap becomes fatal the moment you try to join the networks:
- VPC peering connections cannot be created between VPCs with overlapping CIDR blocks.
- A transit gateway route table cannot hold two routes for the same prefix pointing at different attachments.
- A Site-to-Site VPN or Direct Connect link into an on-premises network with the same range will not route.
Plan the address space centrally before the first VPC is created, and record the allocations somewhere the whole organisation can read. Amazon VPC IP Address Manager (IPAM) exists to do this bookkeeping if a spreadsheet is not enough.
Public address space
Section titled “Public address space”Never use address space allocated to somebody else on a network that touches the internet. Public addresses come from a regional internet registry or from your provider — in AWS, from the pool AWS assigns, or from your own range brought to AWS with BYOIP. Private addresses reach the internet through NAT.
Historical note
Section titled “Historical note”IPv4 was originally divided into fixed classes, and large Class A blocks were handed to universities, government departments and early corporate adopters. That system was replaced by CIDR, which allows any prefix length and therefore much finer allocation. IANA allocated the last unreserved IPv4 blocks to the regional registries in 2011; growth since then has come from CIDR efficiency, address markets, carrier-grade NAT and IPv6.