What does /28 mean?
A /28 has 16 addresses and 14 usable hosts, with netmask 255.255.255.240. For example, 10.0.1.0/28 runs from 10.0.1.0 to 10.0.1.15.
Worked example: 10.0.1.0/28. Type any block to compare.
10.0.1.0/28 is 16 addresses: 10.0.1.0 to 10.0.1.15. 14 usable for hosts (the first is the network address, the last is broadcast).
- Network
10.0.1.0- First usable
10.0.1.1- Last usable
10.0.1.14- Broadcast
10.0.1.15- Addresses
16- Usable hosts
14- Netmask
255.255.255.240- Wildcard (ACL) mask
0.0.0.15- Historic class
A- Range type
Private network · not routed on the internet
Special-purpose range
Private network 10.0.0.0/8 RFC 1918
The largest of the three private IPv4 ranges: 16.7 million addresses for use inside homes and organisations. Not routed on the public internet.
Split it into subnets
4 subnets.
| Subnet | Usable range | Hosts | Broadcast |
|---|---|---|---|
10.0.1.0/30 | 10.0.1.1 – 10.0.1.2 | 2 | 10.0.1.3 |
10.0.1.4/30 | 10.0.1.5 – 10.0.1.6 | 2 | 10.0.1.7 |
10.0.1.8/30 | 10.0.1.9 – 10.0.1.10 | 2 | 10.0.1.11 |
10.0.1.12/30 | 10.0.1.13 – 10.0.1.14 | 2 | 10.0.1.15 |
Is this IP in the range?
Range to CIDR blocks
What to know
/28 is the smallest subnet (and the smallest VPC) AWS allows. AWS reserves 5 addresses in every subnet: the network address, the next three (VPC router, DNS, and one reserved for future use) and the last address. That leaves 11 usable in a /28: 10.0.1.4 to 10.0.1.14.
Outside the cloud, a /28 is a small public block an ISP might route to a business, or a tiny segment for a few appliances.
Gotchas
- In AWS, .1, .2 and .3 of every subnet are taken, so you cannot give an instance 10.0.1.1 even though it is a normal host address elsewhere.
- A /28 leaves almost no room to scale. Use it for subnets whose size is fixed by design, such as a transit or firewall subnet.