Designing Cloud VPCs and Subnet Layouts: Practical CIDR Slicing Guide

When provisioning a new cloud environment in AWS, Microsoft Azure, or Google Cloud, selecting the root Virtual Private Cloud (VPC) CIDR block is one of the most critical irreversible decisions. Under RFC 1918, three private address ranges are available: - **10.0.0.0/8 (16.7M IPs):** The enterprise standard. Provides immense headroom for multi-region VPC peering and transit gateway routing. - **172.16.0.0/12 (1.0M IPs):** Ideal for mid-sized organizations and isolated development sandboxes. - **192.168.0.0/16 (65,536 IPs):** Best suited for branch offices, VPN client pools, and small deployments. For production cloud VPCs, sizing between `/16` (65,536 total addresses) and `/20` (4,096 addresses) offers the ideal balance of scalability without squandering corporate address space.

High availability requires deploying services across at least two or three Availability Zones (AZs). The industry standard architecture divides your VPC into three security tiers: | Tier Name | Subnet Purpose | Routing & Ingress Rules | | :--- | :--- | :--- | | **Public DMZ** | Internet-facing ALBs, NAT Gateways | Default route (`0.0.0.0/0`) targets an Internet Gateway (IGW). | | **Private App** | Kubernetes Pods, ECS Containers, EC2 | Outbound internet routed via NAT Gateway; no public IP addresses. | | **Isolated Data** | RDS PostgreSQL, Redis, DynamoDB VPC endpoints | Completely isolated; zero internet routing or public interfaces. | By allocating equal `/20` or `/24` blocks to each tier across Availability Zones A, B, and C, network teams ensure uniform scaling and predictable routing tables.

# Production AWS VPC (10.0.0.0/16)
- Public Subnet AZ-A:   10.0.0.0/24   (251 usable hosts)
- Public Subnet AZ-B:   10.0.1.0/24   (251 usable hosts)
- Private App AZ-A:     10.0.16.0/20  (4,091 usable hosts)
- Private App AZ-B:     10.0.32.0/20  (4,091 usable hosts)
- Database Tier AZ-A:   10.0.48.0/24  (251 usable hosts)
- Database Tier AZ-B:   10.0.49.0/24  (251 usable hosts)

A frequent rookie error is assuming that a `/24` subnet provides 254 usable host addresses in cloud environments. In standard on-premises networking, only 2 addresses are reserved (Network ID and Broadcast). However, major cloud providers like AWS reserve **5 IP addresses** in every subnet: 1. `x.x.x.0`: Network address. 2. `x.x.x.1`: Reserved by AWS for the VPC router. 3. `x.x.x.2`: Reserved by AWS for internal DNS resolution (AmazonProvidedDNS). 4. `x.x.x.3`: Reserved by AWS for future protocol extensions. 5. `x.x.x.255`: Network broadcast address (broadcast is not supported in VPCs, but reserved). Therefore, a `/24` subnet provides exactly **251 usable IP addresses**, not 254. When sizing micro-subnets (like `/28` with 16 total IPs), having 5 reserved leaves only 11 usable IPs for container workloads.