Skip to main content
A CIDR block describes a continuous range of IP addresses. Cloud providers use CIDR notation to decide which addresses belong to a network, a subnet, or an access rule. Updated October 9, 2026. You will see values such as 10.0.0.0/16 and 10.0.4.0/24 throughout AWS networking. The address before the slash identifies the range. The number after the slash tells you how many leading bits are fixed.

​
Read the slash number

IPv4 addresses contain 32 bits. A /24 fixes the first 24 bits and leaves 8 bits for addresses inside the range. That gives the block 256 addresses because 2^8 = 256. A smaller slash number means a larger address range. A /16 contains many /24 networks. A /28 is much smaller than a /24.
AWS reserves five IPv4 addresses in every VPC subnet. A /24 therefore has 251 addresses available to resources, not 256.

​
VPC blocks and subnet blocks

A VPC receives a CIDR block such as 10.20.0.0/16. Every subnet must use a non-overlapping portion of that VPC range. For example, you could divide the VPC across two Availability Zones:
The public and private labels are not properties of CIDR itself. Route tables decide whether a subnet has a route to an internet gateway, NAT gateway, or private endpoint.

​
Why overlap causes problems

Networks use the destination address to choose a route. If two connected networks both claim 10.20.0.0/16, a router cannot reliably know which network should receive traffic. Overlap commonly appears when teams create VPCs independently and connect them later through peering, a transit gateway, a VPN, or another private network. Fixing it can require renumbering workloads, which is much harder than reserving ranges early.
Do not copy the same default CIDR into every environment if those environments may ever communicate. Allocate distinct ranges for production, staging, development, and shared services.

​
A practical planning method

  1. Reserve a private address range for the organization.
  2. Allocate a distinct block to each account, region, or environment.
  3. Divide each VPC into subnets by Availability Zone and purpose.
  4. Leave unused space between allocations for growth.
  5. Record the assignments in one source of truth.
Do not make every subnet as small as possible. ECS tasks, load balancers, databases, VPC endpoints, and temporary deployment capacity all consume addresses. Running out of subnet addresses can stop new tasks from launching even when compute capacity is available.

​
What about IPv6?

IPv6 uses 128-bit addresses and much larger ranges. AWS commonly assigns a /56 IPv6 block to a VPC and uses /64 blocks for subnets. The planning goal remains the same: use predictable, non-overlapping allocations and understand where routes send traffic.

​
The useful mental model

Think of a CIDR block as a boundary, not as a network feature by itself. It answers one question: which IP addresses belong to this range? Route tables, security groups, network ACLs, gateways, and endpoints decide what those addresses can reach. When Springwinter creates resources in your AWS account, those resources still consume addresses from your VPC and subnets. Understanding CIDR helps you diagnose exhausted subnets, connection failures, and future network integrations without treating the VPC as a black box.

​
Frequently asked questions

A /24 fixes 24 of the 32 bits in an IPv4 address and leaves 8 bits for host addresses. The block contains 256 total addresses. AWS reserves five addresses in each subnet, leaving 251 addresses available to resources.
Size an AWS VPC for current workloads, deployment surge, managed-service ENIs, and expected growth. Leave room for additional subnets and avoid ranges used by networks you may connect later. A /16 is common, but the correct block depends on the address plan.
Two isolated VPCs can use the same CIDR block, but overlapping ranges prevent straightforward routing when you later connect them with peering, Transit Gateway, VPN, or another private network. Allocate unique ranges when future connectivity is plausible.

​
Sources and further reading

Last modified on October 8, 2026