172.16.0.0/12: The Middle Private Range

172.16.0.0/12 is the second RFC 1918 private range. It covers 172.16.0.0 to 172.31.255.255 — sixteen /16s, about a million addresses. It is the least used of the three in offices, but the most used by containers.

172.16.0.0/12 at a glance

Address range
172.16.0.0 – 172.31.255.255
Usable hosts
1,048,574
Total addresses
1,048,576
First usable
172.16.0.1
Last usable
172.31.255.254
Subnet mask
255.240.0.0
Wildcard mask
0.15.255.255
Type
Private (RFC 1918)

Is an address inside 172.16.0.0/12?

Yes — 172.20.3.4 is inside 172.16.0.0/12. It is address number 262,916 in the block (counting from 0).

What 172.16.0.0/12 is

The block size in the second octet is 16 (mask 255.240.0.0), so the range is 172.16.x.x to 172.31.x.x. 172.15.x.x and 172.32.x.x are public.

Because offices rarely use it, Docker and AWS picked addresses from it as defaults — which is exactly why it causes surprises when an office or VPN does use it.

Who uses it

  • Docker

    The default docker0 bridge is 172.17.0.0/16. Each new network takes the next /16: 172.18, 172.19 and so on up to 172.31.

  • AWS default VPCs

    Every AWS account's default VPC is 172.31.0.0/16, with /20 subnets per AZ.

  • Corporate VPNs

    Some companies use 172.16.0.0/12 for VPN pools precisely because home routers don't.

Conflicts and gotchas

  • Docker eats corporate routes. If your office or VPN uses 172.18.0.0/16, a Docker network on a laptop can take the same block and break access to those hosts. Set default-address-pools in Docker's daemon.json to a range you don't use.
  • Writing /16 when you mean /12. A NAT or firewall rule for 172.16.0.0/16 covers only 172.16.x.x and misses the other fifteen /16s.
  • Assuming 172.x is all private. 172.217.0.0/16 is Google; 172.64.0.0/13 is Cloudflare. Only 172.16–172.31 are private.

How to split 172.16.0.0/12

Worked example: into /16s

  1. Going from /12 to /16 borrows 16 − 12 = 4 bits from the host part.
  2. Each borrowed bit doubles the number of subnets: 24 = 16 subnets.
  3. Each /16 keeps 32 − 16 = 16 host bits: 216 = 65,536 addresses, so 65,534 usable after removing network and broadcast.
  4. The new mask is 255.255.0.0, so subnets step by 1 in the second octet: 172.16.0.0/16, 172.17.0.0/16, 172.18.0.0/16 … up to 172.31.0.0/16.
Ways to split 172.16.0.0/12
Split into Subnets Usable each First blocks Good for
/16 16 65,534 172.16.0.0/16, 172.17.0.0/16, … Sixteen /16s — the natural unit Docker and AWS use.
/14 4 262,142 172.16.0.0/14, 172.20.0.0/14, … Four blocks of four /16s, e.g. by environment.
/20 256 4,094 172.16.0.0/20, 172.16.16.0/20, … 256 /20s, the AWS default-subnet size.

172.16.0.0/12 FAQ

Is 172.32.0.0 private?

No. The private range ends at 172.31.255.255. 172.32.0.0 and above are public.

Why is the 172 private range a /12?

RFC 1918 reserved sixteen old Class B networks (172.16 to 172.31). Sixteen /16s together form exactly one /12.

How do I match all of 172.16.0.0/12 in a Cisco ACL?

Use wildcard 0.15.255.255: access-list 10 permit 172.16.0.0 0.15.255.255. The 15 lets the second octet vary from 16 to 31.

Related tools

CIDR to IP Range Every address in 172.16.0.0/12 CIDR Calculator Split 172.16.0.0/12 into any size Subnet Overlap Checker Check it against your other ranges VLSM Calculator Split it into different-sized subnets /12 explained Mask, block size and maths for any /12

Other well-known networks: 10.0.0.0/24, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.17.0.0/16, 192.168.0.0/16, 192.168.0.0/24, 192.168.1.0/24 · all networks