Network Engineer

Subnetting for network engineers: CIDR cheat sheet for VPC and LAN design

Last updated 2026-06-24

Memorize the four CIDR values you use weekly: /24 (254 hosts), /22 (1022), /28 (14), /30 (2). Derive the rest from 2^(32-prefix) minus 2 for the network and broadcast addresses.

Results

Network Address

192.168.1.0

Broadcast Address

192.168.1.255

Usable Host Range

192.168.1.1 - 192.168.1.254

Total Usable Hosts

254

Subnet Mask

255.255.255.0

Binary Subnet Mask

11111111.11111111.11111111.00000000

Interactive Bit-Level Visualizer

Click any bit to flip it and instantly update the IP address. The small number under each bit is its place value. Network bits are indigo, host bits are fuchsia.

A /24 home network, pre-loaded. Widen to /23 or /16, or type your VPC's CIDR block.

Edit in the full tool

Network engineers do CIDR math daily when designing VPCs, sizing VLANs, and writing firewall rules. The key numbers to memorize: /24 = 254 usable hosts, /22 = 1022, /28 = 14, /30 = 2 (point-to-point links). Everything else is derivable from the 2^(32-prefix) formula.

Why this matters for you

In AWS VPC design, a /16 gives 65,536 IPs split across subnets. A typical 3-tier web app uses a /24 public subnet (ALB), a /24 private app subnet, and a /24 data subnet, leaving room for a /28 management subnet. In on-prem VLAN design, a /24 per floor or department is the default, but dense IoT deployments may need a /22 to avoid running out of DHCP leases.

Cloud subnets give you fewer hosts

AWS reserves five addresses in every VPC subnet: the network address, the next three for the VPC router, DNS and future use, and the last address. A /24 in AWS has 251 usable addresses instead of 254, and a /28 has 11 instead of 14. AWS also limits IPv4 subnets to sizes between /16 and /28, so a /28 is the smallest you can create there.

Plan ranges that won't collide

Pick VPC and office ranges from the private blocks in RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Many home routers default to 192.168.0.0/24 or 192.168.1.0/24, so a remote worker on one of those can't reach a cloud subnet that uses the same range over VPN. A less common range inside 10.0.0.0/8 avoids most of these clashes.

Leave room to summarize, too. Four neighboring /24s from 10.20.0.0 to 10.20.3.0 collapse into one route, 10.20.0.0/22, which keeps route tables and firewall rules short.

Router links and IPv6

For a link between two routers, a /31 gives exactly two addresses with no network or broadcast address, as RFC 3021 allows. Many teams still use /30 where older gear doesn't support /31. On IPv6, LAN segments use /64. SLAAC, the way hosts set up their own addresses, expects a 64-bit interface ID, so a smaller IPv6 subnet breaks it.

Verdict

Learn the four common sizes and work out the rest from 2^(32-prefix) minus 2. In AWS each subnet loses five addresses instead of two, so size cloud subnets with that in mind.

Open the Subnet Calculator

Frequently asked questions

How many usable IP addresses does an AWS /24 subnet have?

251. The standard formula gives 254, but AWS also reserves addresses for the VPC router, DNS and future use in every subnet, on top of the network and last address.

Can I use a /31 subnet?

Yes, on a link between two routers. RFC 3021 lets a /31 use both addresses as hosts. Check that every device on the link supports it, and fall back to /30 if one doesn't.

What subnet should I use for a home network?

A /24 such as 192.168.1.0/24 gives 254 usable addresses, which covers most homes, smart devices included. If you connect to a work VPN or a cloud network, pick a less common range so the two don't overlap.