YurlieAWS Subnet Calculator
Plan AWS VPC subnets accurately by accounting for the 5 AWS-reserved IP addresses per subnet block (/16 to /28).
255.255.255.00.0.0.25510.0.0.010.0.0.25510.0.0.410.0.0.254Unlike standard IPv4 networking (which reserves 2 IPs: Network & Broadcast), AWS reserves 5 IP addresses in every VPC subnet block (Base+0 Network, Base+1 VPC Router, Base+2 Amazon DNS, Base+3 Future Use, Base+Last Broadcast). Standard subnetting would yield 254 usable IPs, but AWS yields 251 usable IPs.
AWS IP Address Allocation Breakdown
| IP Address | Allocation / Name | AWS Purpose | Status |
|---|---|---|---|
10.0.0.0 | Network Address | Reserved by AWS for network identifier | Reserved by AWS |
10.0.0.1 | VPC Router | Reserved by AWS for default VPC router gateway | Reserved by AWS |
10.0.0.2 | Amazon DNS Server | Reserved by AWS for Amazon-provided DNS resolver | Reserved by AWS |
10.0.0.3 | AWS Future Use | Reserved by AWS for future expansion/internal service | Reserved by AWS |
10.0.0.4 ... 10.0.0.254 | Usable EC2 / EKS Range | Available for customer workload instances (251 usable IPs) | Usable Host |
10.0.0.255 | Broadcast Address | Reserved by AWS for network broadcast identifier | Reserved by AWS |
Understanding the AWS 5 Reserved IP Address Rule
In traditional IPv4 networking, every subnet reserves 2 IP addresses: the Network Address (first IP) and the Broadcast Address (last IP). However, Amazon Web Services (AWS) reserves five (5) IP addresses in every VPC subnet block, reducing the usable host count for EC2 instances, EKS pods, and RDS databases.
| IP Offset | Allocation / Name | AWS Purpose |
|---|---|---|
Base + 0 | Network Address | Network identifier (Reserved by AWS) |
Base + 1 | VPC Router | Default gateway for instance outbound traffic |
Base + 2 | Amazon DNS Resolver | Base of VPC network range + 2 (AmazonProvidedDNS) |
Base + 3 | AWS Future Use | Reserved by AWS for internal infrastructure services |
Base + Last | Network Broadcast | Reserved broadcast address (VPC does not support broadcast) |
AWS Subnet CIDR Sizing Limits (/16 to /28)
AWS VPC subnet block sizes are restricted between a /16 netmask (maximum 65,536 total IPs) and a /28 netmask (minimum 16 total IPs).
| Prefix | Total IPs | Standard Usable | AWS Usable IPs | Typical AWS Use Case |
|---|---|---|---|---|
/16 | 65,536 | 65,534 | 65,531 | Primary VPC CIDR block |
/20 | 4,096 | 4,094 | 4,091 | Large EKS / K8s worker node pools |
/24 | 256 | 254 | 251 | Public Web Tier / ALB Load Balancers |
/26 | 64 | 62 | 59 | Private App Tier / Microservice Group |
/28 | 16 | 14 | 11 | Small Database Tier / Bastion / Isolated Subnet |
Related Architecture Guide
For a comprehensive deep dive into designing enterprise VPCs across Availability Zones, read our detailed technical guide: AWS VPC Subnet Planning: Best Practices for /24 to /28 Networks ➔
Frequently Asked Questions (FAQ)
Why does AWS reserve 5 IP addresses per subnet?
AWS reserves 5 IP addresses to manage VPC virtual routing (Base+1), internal Amazon DNS resolution (Base+2), and future network expansion (Base+3), alongside standard Network (Base+0) and Broadcast (Base+Last) identifiers.
Can I change or reclaim AWS reserved IP addresses?
No. AWS reserved IP addresses are hardcoded into AWS VPC networking infrastructure and cannot be unreserved or assigned to customer EC2 or ENI interfaces.
What is the minimum subnet size allowed in AWS?
The smallest subnet CIDR allowed in an AWS VPC is /28, which yields 16 total IP addresses and exactly 11 usable IP addresses for host resources.