/28 Subnet: Mask 255.255.255.240

How many /28 networks fit

16 × /28 = one /24. A /28 holds 4 × /30 or 8 × /31.

Worked example: 203.0.113.45/28

Your ISP gave you 203.0.113.45 "in a /28" for your office firewall. What is the whole block, and which addresses are yours to use?

1. The mask is 255.255.255.240. The fourth octet (240) is the "interesting" one — the first that is not 255.
2. Block size = 256 − 240 = 16. Networks start at multiples of 16 in the fourth octet: 0, 16, 32, …
3. The fourth octet of 203.0.113.45 is 45. 45 ÷ 16 = 2 remainder 13, so the block starts at 2 × 16 = 32.
4. Network = 203.0.113.32. Broadcast = 32 + 16 − 1 = 47, giving 203.0.113.47.
5. Usable hosts: 203.0.113.33 to 203.0.113.46, which is 2⁴ − 2 = 14 addresses.

Address  11001011.00000000.01110001.0010|1101
Mask     11111111.11111111.11111111.1111|0000
Network  11001011.00000000.01110001.0010|0000

Where /28 is used in real networks

• Smallest AWS subnet

  AWS subnets can be /16 to /28. AWS reserves 5 addresses (network, VPC router, DNS, future use, broadcast), so a /28 gives only 11 usable IPs. See the AWS subnet calculator.

• Business static IP blocks

  ISPs sell /28s of public space. Usually the ISP's router takes one address, leaving 13 for your firewall, VPN and servers.

• Kubernetes and appliance subnets

  Small fixed-size subnets, like a GKE control-plane range or a firewall's management subnet, are often /28.

Common /28 mistakes

• Planning 14 hosts in an AWS /28. You only get 11. For a subnet that needs 14, use a /27.
• Assigning the ISP's gateway address to your firewall. Ask which address the ISP router uses (often the first or last usable) before configuring anything.

/28 FAQ

Related tools