CIDR Subnetting Guide: Plan Your VPC Network

A practical guide to CIDR notation, subnetting, and planning IP address ranges for AWS VPC, Azure VNet, and Kubernetes clusters.

Understanding CIDR Notation

CIDR (Classless Inter-Domain Routing) is the modern standard for specifying IP address ranges. It uses a slash notation to indicate the network prefix length.

For example: 10.0.0.0/16

10.0.0.0 is the base address
/16 means the first 16 bits are the network prefix, leaving 16 bits for hosts (65,536 addresses)

CIDR Block Quick Reference

| CIDR | Total IPs | Usable (Standard) | Usable (AWS) | |---|---|---|---| | /28 | 16 | 14 | 11 | | /27 | 32 | 30 | 27 | | /26 | 64 | 62 | 59 | | /25 | 128 | 126 | 123 | | /24 | 256 | 254 | 251 | | /23 | 512 | 510 | 507 | | /22 | 1,024 | 1,022 | 1,019 |

Note: AWS reserves 5 IP addresses per subnet (network, router, DNS, future use, broadcast).

Planning a VPC

A well-planned VPC follows a hierarchical structure:

VPC CIDR — The largest block (e.g., 10.0.0.0/16)
Availability Zone subnets — Split the VPC per AZ (e.g., 10.0.0.0/18, 10.0.64.0/18, 10.0.128.0/18)
Tier subnets — Split each AZ into public, private, and database tiers

10.0.0.0/16 (VPC)
├── 10.0.0.0/18 (AZ-1)
│   ├── 10.0.0.0/20  (public)
│   ├── 10.0.16.0/20 (private)
│   └── 10.0.32.0/22 (database)
└── 10.0.64.0/18 (AZ-2)
    ├── 10.0.64.0/20  (public)
    └── ...

Golden Rules

Leave room to grow. Never allocate 100% of your VPC CIDR on day one.
Avoid overlaps. VPCs that need to be peered must have non-overlapping CIDRs.
Use RFC 1918 private ranges. Stick to 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.
Align to powers of 2. Subnets must start at addresses that align with their prefix length.