DMZ Capacity Calculator

addresses = servers + one VIP per service + 4 infrastructure addresses; usable subnet addresses = 2^(32 − prefix) − 2. A DMZ needs an address for every server, a virtual IP for every published service and a handful for the firewall interface, VRRP peers and management. Comparing that total against the usable addresses in your chosen prefix tells you whether the subnet has room to grow, and the rule count follows from services multiplied by rules per service in both directions.

Re-addressing a DMZ is one of the most disruptive changes in a network because every published service, certificate binding and external firewall rule references those addresses — so getting the prefix right the first time matters.

This calculator takes 6 inputs: Internet-facing services published, Servers per service (including redundancy), Public IPv4 addresses available, Peak inbound throughput, Firewall rules per service, DMZ subnet prefix length. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Aim to stay under about 50% utilisation. DMZ growth is lumpy — a single new product line can add a dozen servers and several VIPs — and the cost of a /25 versus a /24 is nothing compared with a re-address project. If you are already past 70%, plan the larger prefix now.