Skip to content

CIDR, Subnetting, NAT#

CIDR notation describes an IP range as prefix/length (10.0.0.0/16 = first 16 bits fixed). Subnetting carves a range into smaller pieces. NAT translates private IP+port to a public IP+port at the edge of a network.

flowchart LR
  subgraph VPC[VPC 10.0.0.0/16]
    S1[Subnet 10.0.1.0/24<br/>public]
    S2[Subnet 10.0.2.0/24<br/>private]
    S3[Subnet 10.0.3.0/24<br/>private]
  end
  S1 --> IGW[Internet gateway]
  S2 --> NAT[NAT gateway] --> IGW
  S3 --> NAT
  IGW --> Internet

    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    class IGW,NAT edge;
    class Internet external;

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
Subnetting concept: large network divided into smaller subnets
Source: Wikimedia Commons. CC BY-SA / public domain.

Every cloud VPC layout, every home router's 192.168.0.0/24, and every IPv4 scarcity workaround uses these primitives.

CIDR notation#

a.b.c.d/n says the first n bits are the network prefix; the remaining 32-n bits are host addresses.

CIDR Hosts (usable) Use
/32 1 A single host
/30 2 Point-to-point links
/29 6 Tiny subnet
/24 254 Classic class C; small subnet
/16 65534 A VPC; class B equivalent
/8 ~16.7M Class A; rarely allocated whole

"Usable" excludes the network address (...0) and broadcast address (...255).

Private IP ranges (RFC 1918)#

Range CIDR Hosts
10.0.0.0/8 10/8 16.7M
172.16.0.0/12 172.16/12 1M
192.168.0.0/16 192.168/16 65K

These never appear on the public internet; routers drop them.

Subnetting math#

10.0.0.0/16          -> /18 splits into 4 subnets
  10.0.0.0/18        -> hosts 10.0.0.0   - 10.0.63.255
  10.0.64.0/18       -> hosts 10.0.64.0  - 10.0.127.255
  10.0.128.0/18      -> hosts 10.0.128.0 - 10.0.191.255
  10.0.192.0/18      -> hosts 10.0.192.0 - 10.0.255.255

Common cloud VPC layout uses one subnet per AZ per role (public / private / database).

NAT mechanics (NAT44 / PAT)#

sequenceDiagram
  participant H as Host 10.0.2.5:50001
  participant N as NAT (public IP 203.0.113.4)
  participant W as Web 142.250.80.46:443
  H->>N: src=10.0.2.5:50001 dst=W:443
  N->>W: src=203.0.113.4:32001 dst=W:443
  Note over N: maps (10.0.2.5:50001) <-> 32001
  W->>N: src=W:443 dst=203.0.113.4:32001
  N->>H: src=W:443 dst=10.0.2.5:50001

NAT keeps a mapping table; on outbound, it rewrites source to a public IP+port; on return traffic, it reverses. Each mapping has a TTL (~30s for UDP, longer for TCP).

NAT limits#

  • Port exhaustion: a single public IP supports ~65k concurrent connections. Use multiple public IPs (NAT pool) or carrier-grade NAT.
  • NAT traversal: incoming connections fail; use STUN/TURN/ICE for peer-to-peer (WebRTC).
  • Source IP: server sees the NAT's IP, not the client's. Lost without X-Forwarded-For / proxy protocol.
  • Hairpin NAT: hosts behind the same NAT trying to reach a public NAT'd address often need explicit support.

Reserved addresses#

Address Purpose
127.0.0.0/8 Loopback
169.254.0.0/16 Link-local; cloud metadata (169.254.169.254)
224.0.0.0/4 Multicast
0.0.0.0 All interfaces / "any"

NAT64 and IPv6 transition#

IPv6 (/128 host, 2001:db8::/32) is becoming default for new deployments. NAT64 translates IPv6 ↔ IPv4 at the edge so IPv6-only clients can reach IPv4 services.

VPC layout pattern#

flowchart TB
  subgraph VPC[VPC 10.0.0.0/16]
    subgraph AZ1[AZ A]
      P1[Public 10.0.1.0/24]
      Pr1[Private 10.0.11.0/24]
      D1[DB 10.0.21.0/24]
    end
    subgraph AZ2[AZ B]
      P2[Public 10.0.2.0/24]
      Pr2[Private 10.0.12.0/24]
      D2[DB 10.0.22.0/24]
    end
    subgraph AZ3[AZ C]
      P3[Public 10.0.3.0/24]
      Pr3[Private 10.0.13.0/24]
      D3[DB 10.0.23.0/24]
    end
  end
  P1 --> IGW[Internet gateway]
  Pr1 --> NAT[NAT gateway in P1]
  NAT --> IGW

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;

Public subnets have a route to an internet gateway; private subnets route outbound traffic via a NAT gateway (so they have egress but no public ingress).

Operational considerations#

  • Plan address space early: changing CIDR after deploy is expensive.
  • Leave room: subnet at /24 even if you only need 50 hosts; growth costs nothing.
  • Don't overlap with VPN peers: if you plan to VPN/peer with another network, leave room.
  • Cloud NAT gateways are not free: ~$0.045/hr each plus data; sometimes a fleet of NAT instances costs less.

Where IP plumbing fits#

flowchart TB
  CN((CIDR + NAT))
  NET[Network basics<br/>IP layer]
  MR[Multi-region DR<br/>VPC layout]
  ANY[BGP + anycast<br/>routing layer above]
  DNS[DNS resolution<br/>name to IP]
  NET --> CN
  CN --> MR
  CN --> ANY
  CN -. paired with .- DNS

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class CN service;
    class NET,MR,ANY,DNS datastore;

Glossary & fundamentals#

Tag Concept What it is Page
HLD Network basics the IP layer overview network-basics
HLD Multi-region DR VPC layout across regions multi-region-dr
HLD BGP anycast routing layer that picks paths bgp-anycast
HLD DNS resolution maps names to those IPs dns-resolution

Quick reference#

CIDR cheat sheet#

Prefix Hosts
/30 2
/29 6
/28 14
/27 30
/26 62
/25 126
/24 254
/16 65534
/8 16.7M

Private ranges (RFC 1918)#

  • 10.0.0.0/8
  • 172.16.0.0/12
  • 192.168.0.0/16

Reserved#

  • 127.0.0.0/8 loopback
  • 169.254.0.0/16 link-local (cloud metadata 169.254.169.254)
  • 224.0.0.0/4 multicast

NAT (PAT) facts#

  • 1 public IP → ~65k connections
  • UDP NAT timeout ~30s; TCP longer
  • No incoming connections unless port-forwarded
  • WebRTC needs STUN/TURN/ICE

VPC layout pattern#

  • /16 VPC per region
  • /24 subnets, public/private/db per AZ
  • Public has internet gateway route
  • Private routes egress via NAT gateway

Planning#

  • Plan address space early
  • Reserve room for growth
  • No overlap with future VPN peers
  • NAT gateways cost real money

Refs#

  • RFC 1918, 4632
  • AWS VPC docs
  • subnet-calculator.com

FAQ#

What is CIDR notation?#

CIDR writes an IP range as address slash prefix length, like 10.0.0.0/16. The number is how many leading bits are fixed; the rest are host bits inside that range.

What is the difference between a public and a private IP address?#

Private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) work only inside a network. Public addresses are globally routable on the internet and unique.

How does NAT work?#

NAT rewrites the source IP and port as packets leave a network and reverses the mapping on the way back. Many private hosts share one public IP via this trick.

What is the difference between SNAT and DNAT?#

SNAT rewrites the source for outgoing traffic so private hosts can reach the internet. DNAT rewrites the destination so external traffic reaches a specific internal host.

How do I size subnets in a VPC?#

Start with a wide block like /16, then carve /24 subnets per availability zone with public, private, and database tiers. Leave room for future zones and overlay services.

Further reading#