GCP VPC Calculator
Plan Google Cloud VPC subnet sizing for auto-mode or custom-mode networks with firewall rule estimates.
Inputs
e.g. allow-internal, allow-ssh, allow-https, deny-all
Usable IPs per Subnet
252
Total Usable IPs (all regions)
756
Estimated Total Firewall Rules
12
Mode Note
Custom mode requires manually creating a subnet with your chosen prefix in each region you use.
Step by step
Values used
VPC Network Mode = Custom mode (manually defined subnets); Number of Regions = 3; Subnet Prefix (custom mode only) = 24 /; Firewall Rules per Subnet = 4
Usable IPs per GCP subnet
usable = 2^(32 − subnet_prefix) − 4
Usable IPs per Subnet
= 252
Total Usable IPs (all regions)
= 756
Estimated Total Firewall Rules
= 12
Mode Note
= Custom mode requires manually creating a subnet with your chosen prefix in each region you use.
How it works
GCP VPCs are global resources with regional subnets, and can operate in auto mode (a /20 subnet, 4,096 addresses, is automatically created in every region as it becomes available) or custom mode (subnets are manually created with an administrator-chosen size per region). GCP reserves 4 IP addresses per subnet — one fewer than AWS/Azure's 5, since GCP does not carve out a separate reserved address for DNS mapping. Firewall rules in GCP apply at the VPC network level (not per-subnet) but are commonly estimated per-subnet during planning to size out baseline security policies like allow-internal, allow-ssh, and default-deny rules.
Formula
Usable IPs per GCP subnet
usable = 2^(32 − subnet_prefix) − 4
Frequently Asked Questions
What's the difference between GCP auto mode and custom mode VPCs?
Auto mode automatically creates a /20 subnet in every GCP region as it's added, using a predefined IP range — simple but inflexible. Custom mode requires you to manually create each subnet with your chosen CIDR range, giving full control over sizing and avoiding auto mode's fixed /20-per-region allocation.
Why does GCP reserve only 4 IPs instead of 5?
GCP's subnet reservation covers the network address, default gateway, a second-to-last reserved address, and broadcast — it doesn't carve out the extra DNS-mapping address that AWS and Azure each reserve, so GCP subnets yield one more usable address than an equivalently-sized AWS/Azure subnet.
Are GCP firewall rules applied per-subnet like AWS security groups?
No — GCP firewall rules apply at the VPC network level using tags, service accounts, or IP ranges to target specific instances, rather than being directly attached per-subnet. This calculator's per-subnet estimate is a planning simplification to size a baseline rule set.
Can auto mode be converted to custom mode later?
Yes, GCP allows converting an auto-mode VPC to custom mode, but this is a one-way operation — once converted, you cannot switch back to auto mode for that network, so this decision should be made deliberately during initial design.