Start free
FREE TOOL

VPC Subnet Calculator

Split an AWS VPC CIDR block into subnets across Availability Zones, see the usable IPs after the 5 reserved ones, and get CloudFormation or Terraform.

  • Your data never leaves your browser: everything is calculated by JavaScript on this page, not on a server.
  • Nothing you enter is uploaded, processed on a server or stored. Check it in your browser's developer tools (Network tab).
  • Once the page has loaded, the tool works without an internet connection.

VPC CIDR block

An IPv4 range from /16 (65,536 addresses) to /28 (16 addresses), ideally from the private ranges 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16.

Subnets

Equal subnets, one after another from the start of the VPC, spread over the Availability Zones in turn - e.g. 4 subnets in 2 zones for a public and a private subnet in each.

The 5 reserved addresses →All subnets →
See the result ↓

Subnets

110.0.0.0/20AZ 110.0.0.4 - 10.0.15.2544,091
210.0.16.0/20AZ 210.0.16.4 - 10.0.31.2544,091
310.0.32.0/20AZ 110.0.32.4 - 10.0.47.2544,091
410.0.48.0/20AZ 210.0.48.4 - 10.0.63.2544,091

Create it

Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
  Subnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.0.0.0/20
      AvailabilityZone: !Select [0, !GetAZs '']
  Subnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.0.16.0/20
      AvailabilityZone: !Select [1, !GetAZs '']
  Subnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.0.32.0/20
      AvailabilityZone: !Select [0, !GetAZs '']
  Subnet4:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.0.48.0/20
      AvailabilityZone: !Select [1, !GetAZs '']
data "aws_availability_zones" "available" {
  state = "available"
}

resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
}

resource "aws_subnet" "main" {
  count             = 4
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 4, count.index)
  availability_zone = data.aws_availability_zones.available.names[count.index % 2]
}
VPC_ID=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 --query Vpc.VpcId --output text)
AZS=($(aws ec2 describe-availability-zones --filters Name=zone-type,Values=availability-zone \
  --query 'AvailabilityZones[].ZoneName' --output text))

aws ec2 create-subnet --vpc-id "$VPC_ID" --cidr-block 10.0.0.0/20 --availability-zone "${AZS[0]}"
aws ec2 create-subnet --vpc-id "$VPC_ID" --cidr-block 10.0.16.0/20 --availability-zone "${AZS[1]}"
aws ec2 create-subnet --vpc-id "$VPC_ID" --cidr-block 10.0.32.0/20 --availability-zone "${AZS[0]}"
aws ec2 create-subnet --vpc-id "$VPC_ID" --cidr-block 10.0.48.0/20 --availability-zone "${AZS[1]}"
VPC and subnet design is a core topic of the AWS Solutions Architect Associate examTry free SAA-C03 practice questions with answers and explanations.SAA-C03 questions →

The 5 IP addresses AWS reserves in every subnet

A subnet in AWS has 5 addresses fewer than its CIDR block: the first four and the last one cannot be assigned to an instance, a load balancer or any other resource. In 10.0.0.0/24 they are:

AddressUsed for
10.0.0.0The network address
10.0.0.1The VPC router
10.0.0.2The Amazon DNS server - at the base of the VPC range plus two; in every other subnet the base plus two is reserved too
10.0.0.3Reserved for future use
10.0.0.255The broadcast address - a VPC does not support broadcast, so it is reserved

So a /24 has 251 usable addresses, not 256 - and not 254 as in a classic network, which only loses the network and broadcast addresses. The smallest subnet, a /28, keeps 11 of its 16.

Subnet sizes

NetmaskAddressesUsable in AWS
/1665,53665,531
/1732,76832,763
/1816,38416,379
/198,1928,187
/204,0964,091
/212,0482,043
/221,0241,019
/23512507
/24256251
/25128123
/266459
/273227
/281611

Both a VPC and a subnet take a CIDR block from /16 to /28. Subnets of one VPC cannot overlap, and a subnet's CIDR block cannot be changed after it is created - so leave room: the calculator shows how much of the VPC is left for subnets you add later. The default VPC is 172.31.0.0/16 with a /20 subnet in each Availability Zone.

Choosing the VPC CIDR block

  • Use a private range from RFC 1918 - 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. A public range works, but traffic to those addresses on the internet then stays inside the VPC.
  • Avoid 172.17.0.0/16: some AWS services, such as SageMaker AI and Cloud9, use it.
  • 0.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16 and 224.0.0.0/4 are not allowed.
  • Plan ranges that do not overlap with your other VPCs and your on-premises network: VPC peering, Transit Gateway and VPN connections need distinct CIDR blocks.
  • A VPC can get secondary CIDR blocks later, but its primary block cannot be resized.

Subnets and Availability Zones

A subnet lives in exactly one Availability Zone. For high availability, create the same set of subnets in at least two zones: e.g. a public subnet (with a route to an internet gateway) and a private subnet in each. The calculator assigns the subnets to zones in turn, and the code picks the zones of the region you deploy to.

Frequently asked questions

How many usable IP addresses are in a /24 subnet in AWS?

251: AWS reserves 5 of its 256 addresses - the first four and the last one.

Why does AWS reserve 5 IP addresses instead of 2?

On top of the network and broadcast addresses, AWS takes the second address for the VPC router, the third for DNS and the fourth for future use.

What is the smallest subnet in AWS?

A /28: 16 addresses, 11 usable. The largest is a /16 with 65,531 usable.

Does the calculator handle IPv6?

Not yet. An IPv6 subnet in AWS is /44 to /64 and also has 5 reserved addresses; with 264 addresses in a /64, running out is not the problem it is in IPv4.

Is my CIDR block sent anywhere?

No. The calculation runs in your browser: nothing you enter is uploaded, processed on a server or stored. The page only counts that the calculator was used, with the subnet size and number chosen, never the CIDR block.

References

Subnet CIDR blocks (Amazon VPC User Guide)
VPC CIDR blocks (Amazon VPC User Guide)
Terraform: cidrsubnet function