AWS VPC CIDR Calculator: Plan Your VPC and Subnets
AWS accepts VPC CIDR blocks from /16 (65,536 addresses) down to /28 (16 addresses), and reserves five addresses in every subnet rather than the usual two. So an AWS /24 subnet gives 251 usable addresses, not 254, and a /28 gives only 11. Enter any CIDR block above to see the network range, host count and AWS-adjusted usable count.
Network
10.0.4.0
Broadcast
10.0.7.255
Netmask
255.255.252.0
Wildcard
0.0.3.255
First host
10.0.4.1
Last host
10.0.7.254
Total addresses
1,024
Usable hosts
1,022
10.0.4.0/22 — cloud providers typically reserve 5 addresses per subnet.
Join the Veojson dispatch
Get the cloud networking cheat sheet for VPC and subnet planning.
One email, no spam, unsubscribe any time.
Choosing the VPC CIDR block
Start with a /16 from a private range you are certain you will not need to peer with — 10.20.0.0/16 for production, 10.30.0.0/16 for staging, and so on, keeping one /16 per environment and region. A /16 gives 65,536 addresses, which sounds excessive until EKS pods, Fargate tasks, VPC endpoints, NAT gateways and RDS subnet groups start consuming them. You can add secondary CIDR blocks later, but you cannot shrink or renumber the primary block without rebuilding, so be generous now.
A subnet layout that scales
Split the VPC across three Availability Zones with a public and a private subnet in each. From 10.20.0.0/16: private subnets 10.20.0.0/20, 10.20.16.0/20 and 10.20.32.0/20 (4,091 usable AWS addresses each), public subnets 10.20.240.0/24, 10.20.241.0/24 and 10.20.242.0/24 (251 each — public subnets hold only load balancers and NAT gateways, so they can be small). That leaves the entire 10.20.48.0 – 10.20.239.255 range free for future tiers, isolated database subnets or a second EKS cluster.
The five reserved addresses
In a 10.20.0.0/24 subnet, AWS reserves 10.20.0.0 (network address), 10.20.0.1 (VPC router), 10.20.0.2 (Amazon DNS resolver, always the VPC base + 2), 10.20.0.3 (reserved for future use) and 10.20.0.255 (broadcast address, although AWS does not support broadcast). Subtract five from the theoretical host count for every subnet you size.
Avoiding overlap you cannot undo
VPC peering, Transit Gateway attachments and site-to-site VPNs all refuse overlapping CIDR ranges. Keep a central register of every allocated block across accounts and regions before anyone creates a VPC, and never use 192.168.0.0/24 or 192.168.1.0/24, because home routers use them and your remote workers' VPNs will collide. If you already have an overlap, the options are all painful: NAT translation, PrivateLink instead of peering, or rebuilding a VPC.
AWS VPC subnet sizes
| CIDR | Total addresses | AWS usable | Typical use |
|---|---|---|---|
| /16 | 65,536 | 65,531 | Whole VPC (maximum size) |
| /18 | 16,384 | 16,379 | Very large workload subnet |
| /20 | 4,096 | 4,091 | Private application / EKS subnet |
| /22 | 1,024 | 1,019 | Medium application subnet |
| /24 | 256 | 251 | Public subnet, small services |
| /26 | 64 | 59 | Database subnet |
| /27 | 32 | 27 | VPC endpoints |
| /28 | 16 | 11 | Smallest allowed — use sparingly |
Example three-AZ layout for 10.20.0.0/16
| Subnet | CIDR | AZ | Purpose |
|---|---|---|---|
| private-a | 10.20.0.0/20 | eu-west-1a | Application and pods |
| private-b | 10.20.16.0/20 | eu-west-1b | Application and pods |
| private-c | 10.20.32.0/20 | eu-west-1c | Application and pods |
| public-a | 10.20.240.0/24 | eu-west-1a | ALB, NAT gateway |
| public-b | 10.20.241.0/24 | eu-west-1b | ALB, NAT gateway |
| public-c | 10.20.242.0/24 | eu-west-1c | ALB, NAT gateway |
| reserved | 10.20.48.0 – 10.20.239.255 | — | Future growth |