VPC CIDR Calculator
Size an Amazon VPC CIDR block, see its usable range, how many subnets it yields and what the five AWS reservations cost you.
Inputs
AWS accepts /16 through /28 for a VPC CIDR block.
Primary CIDR Range
10.0.0.0/16 (10.0.0.0 – 10.0.255.255)
Addresses in Primary Block
65,536
Subnets of the Planned Size
256
Assignable After AWS Reservations
64,256
Addresses Reserved by AWS
1,280
CIDR Blocks Used
2 of 5 allowed per VPC by default
Step by step
Values used
VPC network address = 10.0.0.0; VPC CIDR prefix length = 16 bits; Planned subnet prefix length = 24 bits; Additional CIDR blocks associated = 1 blocks
VPC CIDR
addresses = 2^(32 − prefix); subnets = 2^(subnet prefix − VPC prefix); assignable = addresses − 5 × subnets.
Primary CIDR Range
= 10.0.0.0/16 (10.0.0.0 – 10.0.255.255)
Addresses in Primary Block
= 65,536
Subnets of the Planned Size
= 256
Assignable After AWS Reservations
= 64,256
Addresses Reserved by AWS
= 1,280
CIDR Blocks Used
= 2 of 5 allowed per VPC by default
How it works
The VPC block holds 2^(32 − prefix) addresses, and carving it into subnets of a longer prefix gives a power-of-two subnet count. AWS then takes five addresses out of every subnet — the network address, the VPC router, the Amazon DNS resolver, one address held for future use, and the broadcast address — so the assignable total shrinks as you cut the space into more, smaller subnets. A VPC CIDR cannot be shrunk after creation and overlapping ranges block future peering, Transit Gateway attachments and VPN routes, so the first prefix you pick constrains the account for years.
Formula
VPC CIDR
addresses = 2^(32 − prefix); subnets = 2^(subnet prefix − VPC prefix); assignable = addresses − 5 × subnets.
- 5
- Addresses AWS reserves in every subnet
- prefix
- VPC CIDR prefix length, between 16 and 28
- subnet prefix
- Prefix length of each subnet carved from the VPC
Frequently Asked Questions
How is VPC CIDR calculated?
addresses = 2^(32 − prefix); subnets = 2^(subnet prefix − VPC prefix); assignable = addresses − 5 × subnets. The VPC block holds 2^(32 − prefix) addresses, and carving it into subnets of a longer prefix gives a power-of-two subnet count. AWS then takes five addresses out of every subnet — the network address, the VPC router, the Amazon DNS resolver, one address held for future use, and the broadcast address — so the assignable total shrinks as you cut the space into more, smaller subnets.
Why does VPC CIDR matter?
A VPC CIDR cannot be shrunk after creation and overlapping ranges block future peering, Transit Gateway attachments and VPN routes, so the first prefix you pick constrains the account for years.
What values do I need to enter?
This calculator takes 4 inputs: VPC network address, VPC CIDR prefix length, Planned subnet prefix length, Additional CIDR blocks associated. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Can I change a VPC CIDR block later?
You cannot resize or remove the primary CIDR block. You can associate up to four additional blocks (five in total by default), but they must not overlap anything you peer with, so plan the primary block with room to grow.
Why does a smaller subnet waste proportionally more space?
The five AWS reservations are per subnet, not per VPC. In a /28 (16 addresses) they consume 31% of the block; in a /24 they consume 2%. Splitting a VPC into many tiny subnets can lose thousands of addresses to reservations alone.