Why are two addresses unusable?

The first is the network address and the last is the broadcast address.

Does it support IPv6?

Not yet — this version covers IPv4.

What is the wildcard mask?

The inverse of the netmask, used in Cisco ACLs and some firewall syntaxes.

How do I calculate an AWS VPC CIDR block?

Choose a /16 from a private range you are not using elsewhere, such as 10.20.0.0/16, then carve /20 or /24 subnets from it — one public and one private per Availability Zone. Remember AWS reserves five addresses per subnet and allows only /16 to /28.

How many usable IP addresses are in a /24?

254 on a standard network (256 total minus the network and broadcast addresses), or 251 inside an AWS VPC because AWS reserves five addresses.

What is the smallest subnet AWS allows?

A /28, which contains 16 addresses and 11 usable ones after the five AWS reservations. It is usually too small for anything beyond a tiny endpoint subnet.

How do I convert a subnet mask to a prefix length?

Count the leading 1 bits in the mask. 255.255.255.0 is 24 one-bits, so it is a /24. Enter either form above and the calculator shows the other.

Can two VPCs with overlapping CIDR blocks be peered?

No. VPC peering, Transit Gateway and site-to-site VPN all require non-overlapping ranges, so plan your address space before you create the VPCs.

What is a wildcard mask used for?

Cisco access-control lists and some firewall syntaxes match on the inverse of the subnet mask. For a /24 the wildcard mask is 0.0.0.255.

Does this subnet calculator send my IP addresses anywhere?

No. Every calculation runs locally in your browser, so internal network plans never leave your machine.

Security & Infrastructure

IP Subnet Calculator: Simplify Network Address Planning

CIDR to network, broadcast, host range and mask.

Enter any IPv4 address with a CIDR prefix — for example 10.0.0.0/16 — and this subnet calculator returns the network address, broadcast address, usable host range, subnet mask, wildcard mask and total host count instantly. It also shows the AWS-adjusted usable count, because AWS reserves five addresses in every VPC subnet rather than the usual two.

IPv4 address with CIDR prefix

Network

10.0.4.0

Broadcast

10.0.7.255

Netmask

255.255.252.0

Wildcard

0.0.3.255

First host

10.0.4.1

Last host

10.0.7.254

Total addresses

1,024

Usable hosts

1,022

10.0.4.0/22 — cloud providers typically reserve 5 addresses per subnet.

Join the Veojson dispatch

Get the cloud networking cheat sheet for VPC and subnet planning.

One email, no spam, unsubscribe any time.

About this tool

CIDR notation splits an address into a network prefix and a host portion. This calculator derives every value you need when planning VPC subnets or writing firewall rules.

Planning VPC subnets

Reserve a large block such as 10.0.0.0/16, then carve /24s per tier and availability zone. Cloud providers typically reserve five addresses per subnet.

Reading prefix lengths

Each extra bit halves the block: /24 holds 254 usable hosts, /25 holds 126, /26 holds 62.

How CIDR notation works

CIDR notation writes a network as an address followed by a prefix length: 192.168.1.0/24. The prefix is the number of leading bits that identify the network; the remaining bits identify hosts. A /24 fixes 24 bits, leaving 8 host bits and therefore 2^8 = 256 addresses, of which 254 are usable after removing the network and broadcast addresses. Every step down in prefix length doubles the block: /23 is 512 addresses, /22 is 1,024, and so on. Every step up halves it.

Planning an AWS VPC CIDR block

AWS accepts VPC CIDR blocks between /16 and /28. A /16 (65,536 addresses) is the common default because it leaves room for dozens of subnets across multiple Availability Zones, and it cannot be resized downward later without adding secondary blocks. Split the VPC so each Availability Zone gets a public and a private subnet: with a 10.0.0.0/16 VPC, 10.0.0.0/20, 10.0.16.0/20 and 10.0.32.0/20 give you three roomy private subnets, while /24s carved from the top of the range serve as public subnets. Keep at least one unused /20 in reserve for future services such as EKS pods, RDS subnet groups or VPC endpoints, all of which consume addresses faster than teams expect.

Why AWS subnets have five reserved addresses

In a normal network, two addresses per subnet are unusable: the network address and the broadcast address. AWS reserves five. In a 10.0.0.0/24 subnet these are 10.0.0.0 (network), 10.0.0.1 (VPC router), 10.0.0.2 (DNS resolver), 10.0.0.3 (reserved for future use) and 10.0.0.255 (broadcast, even though AWS does not support broadcast). A /24 therefore gives 251 usable addresses in AWS instead of 254, and a /28 — the smallest allowed — gives only 11. Anything smaller than /28 will be rejected, and /28 subnets fill up the moment a load balancer claims addresses in them.

Choosing private ranges that will not collide

RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private use. Pick ranges that will not overlap with anything you might later peer with: a VPC peering connection, Transit Gateway attachment or site-to-site VPN cannot join two networks with overlapping CIDRs, and fixing it means rebuilding a VPC. Avoid 192.168.0.0/24 and 192.168.1.0/24 entirely, since home and office routers use them and remote-worker VPNs will clash. A good convention is to allocate a distinct /16 out of 10.0.0.0/8 per environment and region — 10.10.0.0/16 for production in one region, 10.20.0.0/16 for staging, and so on.

Subnet masks, wildcard masks and prefix lengths

A subnet mask such as 255.255.255.0 is the dotted-decimal form of the same /24 prefix. A wildcard mask is its bitwise inverse — 0.0.0.255 — and is what Cisco access-control lists and some firewall rules expect. Converting between the three forms by hand is error-prone, especially for non-octet-aligned prefixes such as /27 (255.255.255.224, wildcard 0.0.0.31), which is why the calculator above shows all three for every input.

CIDR prefix reference for IPv4

CIDR	Subnet mask	Total addresses	Usable hosts	Usable in AWS VPC
/16	255.255.0.0	65,536	65,534	65,531
/18	255.255.192.0	16,384	16,382	16,379
/20	255.255.240.0	4,096	4,094	4,091
/22	255.255.252.0	1,024	1,022	1,019
/24	255.255.255.0	256	254	251
/25	255.255.255.128	128	126	123
/26	255.255.255.192	64	62	59
/27	255.255.255.224	32	30	27
/28	255.255.255.240	16	14	11
/29	255.255.255.248	8	6	not allowed
/30	255.255.255.252	4	2	not allowed
/32	255.255.255.255	1	1	not allowed

AWS reserves five addresses per subnet and accepts only /16 through /28 for VPC subnets.

RFC 1918 private address ranges

Range	CIDR	Addresses	Typical use
10.0.0.0 – 10.255.255.255	10.0.0.0/8	16,777,216	Cloud VPCs, large corporate networks
172.16.0.0 – 172.31.255.255	172.16.0.0/12	1,048,576	Docker defaults, mid-size networks
192.168.0.0 – 192.168.255.255	192.168.0.0/16	65,536	Home and small office routers

How to use IP Subnet Calculator

1
Open IP Subnet Calculator
Everything runs on this page — there is nothing to install and no account required to use the free features.
2
Add your input
Paste or enter your values in the panel above. The tool updates as you type, so you can iterate quickly.
3
Review the output
Check the result, copy it with one click, and adjust the options until it matches what your system expects.
4
Take it further
Use the security & infrastructure tips below to make the result production-ready, then unlock the gated extras via the form above.

Best practices

Treat every result as a snapshot — configuration drifts, so re-check after each deploy.
Fix the highest-impact finding first rather than chasing a perfect score.
Apply changes at the shared layer (proxy, CDN, base image) so every service inherits them.
Document what you changed and when; auditors and future teammates will ask.

IP Subnet Calculator — Why it matters

Infrastructure and security misconfigurations are among the most common root causes of real incidents, and almost all of them are cheap to fix once visible.

Leaving them unaddressed means failed audits, blocked enterprise deals, and avoidable exposure.

Related free & paid tools

Tool name	Type	Key features	Link
ipcalc	Free	CLI subnet maths on Linux and macOS	Visit
AWS VPC planner docs	Free	CIDR sizing guidance for cloud networks	Visit
SolarWinds IP Address ManagerOffer	Paid	Enterprise IPAM with subnet discovery	Visit

Some links marked Offer are partner links. They cost you nothing extra and help keep these tools free.