IP Addressing

IP addressing gives network interfaces logical addresses that routers use to deliver packets. IPv4 addresses contain 32 bits and are commonly written in dotted-decimal form, such as 10.20.1.15. IPv6 addresses contain 128 bits and use hexadecimal notation. An interface can have multiple addresses, and an address identifies a network endpoint rather than a permanent application identity. Applications should generally use DNS names when endpoints may change.

Cloud networks allocate addresses from ranges expressed using Classless Inter-Domain Routing, or CIDR. For example, 10.20.0.0/16 contains 65,536 IPv4 addresses. The prefix length indicates how many bits identify the network: a larger prefix number means a smaller address range. Dividing that range into subnets such as 10.20.1.0/24 and 10.20.2.0/24 creates separate address ranges for workloads. Each /24 contains 256 total addresses, but not all are necessarily assignable. In an AWS IPv4 subnet, AWS reserves the first four addresses and the last address, leaving 251 assignable addresses in a /24.

In AWS, a virtual private cloud, or VPC, provides the network boundary and has one or more associated address ranges. A subnet takes an address range from its VPC and exists within one Availability Zone. Engineers commonly place application instances in private subnets across multiple Availability Zones and public-facing load balancers in public subnets. Subnet sizing must account for growth, replacement instances during deployments, and network interfaces created by managed services, not just the current number of virtual machines.

Private IPv4 addresses, including addresses from 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, are not publicly routed on the internet. They can support communication within a cloud network and across connected private networks. Public IPv4 addresses support internet routing, but assigning one does not automatically make a workload reachable. Routing, gateways, security groups, network access control lists, and application listeners must also permit communication.

AWS subnet classification depends on routing, not on the numerical address range. A public subnet has a route to an internet gateway. For an EC2 instance to communicate directly with the internet over IPv4 through that gateway, it also needs a public IPv4 address or an Elastic IP address. The internet gateway maps that public address to the instance's private IPv4 address. A private subnet has no direct route to an internet gateway. Its workloads can initiate outbound IPv4 connections through a public NAT gateway when the necessary routes and internet gateway are configured. NAT does not provide unsolicited inbound internet access to those workloads.

IPv6 offers a much larger address space and can operate alongside IPv4 in a dual-stack network. Globally routable IPv6 addresses do not imply unrestricted access: routes and security controls still govern reachability. In AWS, an egress-only internet gateway supports outbound-initiated IPv6 internet communication while preventing internet hosts from initiating connections through that gateway. IPv6 does not require the public-to-private address translation used for typical EC2 public IPv4 connectivity.

Address planning involves practical trade-offs. Small subnets conserve address space but can exhaust capacity during scaling. Oversized allocations can waste private address space needed for other networks. Overlapping CIDR ranges complicate connectivity, and AWS VPC peering does not support overlapping VPC CIDR blocks. Public IPv4 addresses and NAT gateways can also introduce charges. Plan non-overlapping ranges across cloud environments and on-premises networks, then evaluate addressing, routing, and access controls separately when troubleshooting.