AWS Subnet Calculator
Plan VPC subnets with accurate usable-host counts — the 5 IPs AWS reserves in every subnet are subtracted automatically.
IPv4 Subnet Calculator
Results
Network Map
Summary
AWS Reserved IPs
AWS reserves 5 IP addresses in every VPC subnet: the first four and the last.
Advanced: View Binary Representation
IP addresses are stored as binary numbers (1s and 0s) in computers. This is how your network looks in binary:
Advanced Features
🔍 Compare Two Subnets
Compare two subnets to see if they overlap, contain each other, or are completely separate.
Comparison Results
The subnets are completely separate - they do not share any IP addresses.
🧮 VLSM Calculator (Variable Length Subnet Masking)
Create multiple subnets of different sizes from a single network. VLSM optimizes IP address utilization by allocating exactly the right subnet size for each requirement.
VLSM Benefits:
- • Reduces IP address waste by up to 80%
- • Automatically calculates optimal subnet sizes
- • Perfect for complex network designs
- • Supports up to 100 different subnet requirements
Need to Validate IP Addresses?
Before configuring your subnets, ensure your IP addresses are properly formatted with our comprehensive IP validator. Supports both IPv4 and IPv6 with detailed analysis and error detection.
Validate IP AddressesAlso see: general subnet calculator · Azure subnet calculator · GCP subnet calculator
The 5 IPs AWS reserves in every subnet
Every subnet you create in a VPC loses five addresses before you assign a single ENI. For a
10.0.0.0/24 subnet:
10.0.0.0Network address. Standard IPv4 — identifies the subnet itself and is never assignable.10.0.0.1VPC router. The implicit router that serves as the default gateway for the subnet. There is no gateway appliance to manage; AWS pins it to the second address of every subnet.10.0.0.2Amazon-provided DNS. The Route 53 Resolver endpoint is anchored at the VPC network range plus two, and AWS additionally reserves the third address in every subnet for DNS.10.0.0.3Reserved for future use. Not in service today, but blocked so AWS can introduce features without renumbering customer subnets.10.0.0.255Broadcast address. VPCs do not support broadcast traffic, but the address is still withheld.
The result: a /24 gives you 251 usable addresses, not the 254 a generic subnet calculator reports. In small subnets the tax is proportionally brutal — a /28 keeps only 11 of its 16 addresses.
VPC vs subnet CIDR rules
A VPC's primary CIDR block must be between /16 and /28, and every subnet has to be carved from a CIDR block of the VPC — the same /16-to-/28 limit applies to subnets themselves. A subnet can equal the full VPC CIDR, but subnets within one VPC can never overlap each other. Each subnet lives in exactly one Availability Zone, so a three-AZ design needs at least three subnets per tier.
If you run out of space, you can attach up to four additional IPv4 CIDR blocks to the VPC — but the new ranges must not overlap existing ones, and some ranges (for example anything inside 198.19.0.0/16 when your primary is RFC 1918 space) are restricted. Subnets themselves are immutable: there is no resize operation.
Common VPC address planning pitfalls
- Every VPC gets 10.0.0.0/16. It works until you need VPC peering, Transit Gateway, or a VPN back to the office — then identical ranges collide and you are stuck NATing or renumbering. Allocate distinct blocks per VPC from an IPAM plan.
- Forgetting the 5-IP tax on small subnets. Teams size a /28 for "a couple of instances" and discover only 11 addresses remain. If a subnet holds a load balancer, remember ELB itself consumes IPs per AZ as it scales.
- EKS eating subnets alive. With the VPC CNI plugin, every pod takes a real IP from the subnet. A /24 that looked generous is exhausted by one moderately sized node group. Give EKS worker subnets /20 or larger, or use secondary CIDR ranges for pods.
- No headroom for growth. Because subnets cannot be resized, leave unallocated space inside the VPC CIDR for future subnets and future AZs instead of tiling the whole block on day one.
AWS Subnet FAQ
How many usable IPs are in a /24 AWS subnet?
251. A /24 contains 256 addresses, but AWS reserves 5 of them: the network address (.0), the VPC router (.1), the Amazon-provided DNS address (.2), one reserved for future use (.3), and the broadcast address (.255). A generic calculator says 254, which is wrong for AWS.
Why does AWS reserve 5 IP addresses in every subnet?
The first address is the network address and the last is the broadcast address, as in any IPv4 subnet. On top of that, AWS uses the second address for the implicit VPC router (your subnet's default gateway), the third for the Amazon-provided DNS resolver, and holds the fourth for future use. These reservations apply to every subnet in every VPC and cannot be released.
What is the smallest subnet size allowed in an AWS VPC?
/28, which is 16 addresses. After the 5 reserved IPs are subtracted, a /28 gives you only 11 usable addresses. The largest allowed is /16 (65,536 addresses, 65,531 usable). Both VPC CIDR blocks and subnets must fall in the /16–/28 range.
Can I resize an AWS subnet after creating it?
No. Subnet CIDR blocks in AWS are immutable — you cannot grow or shrink a subnet once it exists. Your options are to create a new, larger subnet and migrate resources, or to add a secondary CIDR block to the VPC and create additional subnets there. This is why capacity headroom matters when you pick subnet sizes.
More Network Tools
Free tools for network engineers — no signup, no rate-limit walls.