Skip to content
ENExplore Calculators

DMZ Capacity Calculator

Plan a DMZ: server count, addresses needed against the subnet size, VIP density per public IP and firewall rule load.

About DMZ Capacity Calculator

A DMZ needs an address for every server, a virtual IP for every published service and a handful for the firewall interface, VRRP peers and management. Comparing that total against the usable addresses in your chosen prefix tells you whether the subnet has room to grow, and the rule count follows from services multiplied by rules per service in both directions. Re-addressing a DMZ is one of the most disruptive changes in a network because every published service, certificate binding and external firewall rule references those addresses — so getting the prefix right the first time matters.

Formula

DMZ Capacity

addresses = servers + one VIP per service + 4 infrastructure addresses; usable subnet addresses = 2^(32 − prefix) − 2.

servers
Published services × servers per service
infrastructure addresses
Firewall interface, VRRP pair and management address

Worked example

With the default values below, DMZ Capacity Calculator returns DMZ Addresses Required of 100. Change any input above and every figure here is recalculated in your browser.

Inputs used

Internet-facing services publishedaccepts 1–10,000 services
24 services
Servers per service (including redundancy)accepts 1–100 servers
3 servers
Public IPv4 addresses availableaccepts 1–4,096 addresses
8 addresses
Peak inbound throughputaccepts 0.01–1,000 Gbps
2.5 Gbps
Firewall rules per serviceaccepts 1–64 rules
4 rules
DMZ subnet prefix lengthaccepts 20–30 bits
25 bits

Results

DMZ Addresses Required
100
DMZ Servers
72
Usable Addresses in Subnet
126
Subnet Utilisation
79.4%
Services per Public IP
3.00
Firewall Rules Required
194
Throughput per Server
34.7 Mbps

Step by step

  1. 1Values used
  2. 2DMZ Capacity
  3. 3DMZ Addresses Required= 100
  4. 4DMZ Servers= 72
  5. 5Usable Addresses in Subnet= 126
  6. 6Subnet Utilisation= 79.4
  7. 7Services per Public IP= 3.00
  8. 8Firewall Rules Required= 194

Assumptions and limits

  • The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is DMZ Capacity calculated?

addresses = servers + one VIP per service + 4 infrastructure addresses; usable subnet addresses = 2^(32 − prefix) − 2. A DMZ needs an address for every server, a virtual IP for every published service and a handful for the firewall interface, VRRP peers and management. Comparing that total against the usable addresses in your chosen prefix tells you whether the subnet has room to grow, and the rule count follows from services multiplied by rules per service in both directions.

Why does DMZ Capacity matter?

Re-addressing a DMZ is one of the most disruptive changes in a network because every published service, certificate binding and external firewall rule references those addresses — so getting the prefix right the first time matters.

What values do I need to enter?

This calculator takes 6 inputs: Internet-facing services published, Servers per service (including redundancy), Public IPv4 addresses available, Peak inbound throughput, Firewall rules per service, DMZ subnet prefix length. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

How much headroom should a DMZ subnet have?

Aim to stay under about 50% utilisation. DMZ growth is lumpy — a single new product line can add a dozen servers and several VIPs — and the cost of a /25 versus a /24 is nothing compared with a re-address project. If you are already past 70%, plan the larger prefix now.

Related Calculators

DMZ Capacity Calculator – Calculate DMZ Addresses Required