Subnets and IP ranges

Both problems come from choosing address ranges without a plan. This lesson is that plan: how to read a range, how big to make each one, and how to keep them apart.

The VPC lesson showed that every range is written like 10.0.0.0/16, and that a smaller number after the slash means a bigger range. Here’s why.

An address is 32 bits

An IPv4 address like 10.0.11.24 is four numbers, each from 0 to 255. Each number is one octet: 8 bits. Four octets make 32 bits.

A computer only sees the 32 bits. The dots are for people.

The slash says how many bits are fixed

In 10.0.0.0/16, the /16 means the first 16 bits are fixed. Every address in the range starts with the same 16 bits: 10.0. The other 16 bits are free: they can be anything.

Each free bit doubles the number of addresses. So the size of a range is 2 to the power of the free bits:

That’s the whole trick: free bits = 32 − the number after the slash; addresses = 2 to that power. One step down the slash doubles the size. One step up halves it.

Every block starts on its own boundary

A range is written as its first address. And a block of a given size can only start at a multiple of that size.

A /20 holds 4,096 addresses — 16 blocks of 256. So a /20 always starts where the third number is a multiple of 16:

The same rule at every size: a /24 starts at x.x.x.0, a /26 at .0, .64, .128 or .192, a /28 at a multiple of 16 in the last number. If a range doesn’t start on its boundary, the free bits wouldn’t all be free — some would already be set. AWS rejects it.

AWS keeps five addresses in every subnet

In every subnet, AWS reserves the first four addresses and the last one. For 10.0.11.0/24:

So a /24 gives you 251 usable addresses, and the smallest subnet AWS allows, a /28, gives only 11. The five matter most in small subnets.

Which ranges to use at all

Three ranges are set aside for private networks. Nothing on the internet uses them, so they’re safe inside a VPC:

A VPC can be anything from a /16 (65,536 addresses) down to a /28. Subnets have the same limits.

Planning for growth

A plan is cheap on paper and very expensive to change later. Three rules:

QuickCart’s plan for its first VPC, 10.0.0.0/16. The third number tells you the tier and the zone at a glance:

Six subnets use 1,536 of 65,536 addresses. More than 95% of the VPC is left for things nobody has thought of yet. The second region gets 10.1.0.0/16 with the same layout, so the two can be joined whenever they need to be.

Below is QuickCart’s VPC, 10.0.0.0/16, drawn as a map: one square for every /24. Pick a size and a starting address, and add a subnet. Watch the bits, the address count, and the map. Then try to break it: start a /20 at 10.0.1.0, and add a /24 that lands on top of one that’s already there.

What to notice: each step down in the slash doubles the addresses and halves the number of blocks that fit. A block only fits where its fixed bits line up, and nothing may overlap — the two rules AWS enforces every time you create a subnet.

Free — VPCs and subnets cost nothing.

You’ll plan QuickCart’s addresses on paper, build part of the plan, and deliberately hit the two errors from this lesson so you recognise them. About 20 minutes.

Check the region selector at the top right of the console says N. Virginia (us-east-1).

1. Plan on paper first

   Before opening the console, write down the plan from the idea: one VPC, and a public, app and data subnet in each of two zones. For each subnet, work out:

   Subnet	Range	Addresses	Usable	First usable	Last usable
   quickcart-public-a	10.0.1.0/24	256	251	10.0.1.4	10.0.1.254
   quickcart-app-a	10.0.11.0/24	256	251	10.0.11.4	10.0.11.254
   quickcart-data-a	10.0.21.0/24	256	251	10.0.21.4	10.0.21.254

   Fill in the zone b rows yourself — 10.0.2.0/24, 10.0.12.0/24 and 10.0.22.0/24 — and check your answers with the planner above.

   You should see

   A table where no two ranges share an address, every range is inside 10.0.0.0/16, and most of the VPC is still unused.

2. Create the VPC

   AWSIn the AWS console: VPC→Your VPCs→Create VPC

   Field	Enter
   Resources to create	VPC only
   Name tag	quickcart-vpc
   IPv4 CIDR block	IPv4 CIDR manual input
   IPv4 CIDR	10.0.0.0/16
   IPv6 CIDR block	No IPv6 CIDR block
   Tenancy	Default

   Choose Create VPC.

   You should see

   The VPC’s details page, with State: Available and IPv4 CIDR: 10.0.0.0/16.

3. Create the zone a subnets

   AWSIn the AWS console: VPC→Subnets→Create subnet

   For VPC ID, choose quickcart-vpc. Fill in the first subnet, choose Add new subnet for each of the others, then choose Create subnet:

   Subnet name	Availability Zone	IPv4 subnet CIDR block
   quickcart-public-a	us-east-1a	10.0.1.0/24
   quickcart-app-a	us-east-1a	10.0.11.0/24
   quickcart-data-a	us-east-1a	10.0.21.0/24

   You should see

   Three subnets in the list. The Available IPv4 addresses column says 251 for each: 256 minus the five AWS keeps.

4. Create the zone b subnets

   Same page, same VPC:

   Subnet name	Availability Zone	IPv4 subnet CIDR block
   quickcart-public-b	us-east-1b	10.0.2.0/24
   quickcart-app-b	us-east-1b	10.0.12.0/24
   quickcart-data-b	us-east-1b	10.0.22.0/24

   You should see

   Six subnets, three in each zone, each with 251 available addresses.

5. Try a block that isn't on its boundary

   Create one more subnet in quickcart-vpc:

   Field	Enter
   Subnet name	quickcart-containers-a
   Availability Zone	us-east-1a
   IPv4 subnet CIDR block	10.0.33.0/20

   Choose Create subnet.

   You should see

   quickcart-containers-a in the list with 4091 available addresses: 4,096 minus five.

6. Try a range that overlaps

   Create one more subnet:

   Field	Enter
   Subnet name	quickcart-extra-a
   Availability Zone	us-east-1a
   IPv4 subnet CIDR block	10.0.40.0/24

   Choose Create subnet.

7. Clean-up step: Clean up

   AWSIn the AWS console: VPC→Your VPCs→quickcart-vpc→Actions→Delete VPC

   AWS lists the subnets that go with it. Type delete in the box and choose Delete.

   You should see

   The VPC and all seven subnets are gone. Nothing was charged; keep your paper plan for the routing lesson.