Skip to main content
In this lesson we cover subnets in Amazon VPCs — what they are, how they relate to Availability Zones (AZs), CIDR and reserved IP rules, and common configuration options (public vs private, IPv6, auto-assign public IPs). A subnet is a contiguous range of IP addresses within a VPC that you use to place resources. When you launch a resource (for example, an Amazon Elastic Compute Cloud (EC2) instance), you select a subnet — and because subnets are AZ-scoped, that selection also determines the Availability Zone where the resource will run. For example:
  • Subnet A exists in Availability Zone us-east-1a. Any resource launched into Subnet A runs in us-east-1a.
  • Subnet B exists in Availability Zone us-east-1b. Any resource launched into Subnet B runs in us-east-1b.
Subnets are commonly classified as public or private:
  • Public subnet: Has a route to an Internet Gateway (IGW) and, when instances have public IPs, they can be reached from the internet.
  • Private subnet: Lacks a direct route to an IGW. Instances here usually access the internet via a NAT Gateway or NAT instance if required.
A diagram showing a VPC inside a region with two availability zones: a public subnet (172.16.0.0/24) and a private subnet (172.16.1.0/24) within a default VPC (172.16.0.0/16). The image also lists that subnets are groups of IPs in a VPC, reside in a single AZ, and can be public or private.

​
Subnet CIDR rules and reserved addresses

Key CIDR and addressing rules when designing subnets:
  • A subnet’s CIDR block must be a subset of the VPC’s CIDR block. For example, if your VPC CIDR is 192.168.0.0/16, valid subnet CIDR examples include:
Invalid example (outside the VPC range):
  • AWS reserves five addresses in every subnet:
    • The network address (first address, e.g., .0) — not usable.
    • The first three usable addresses (.1 through .3) — reserved by AWS for network appliances (VPC router, Amazon DNS, future use).
    • The broadcast-like address (last address, e.g., .255) — reserved. Example for a 192.168.10.0/24 subnet:
    • 192.168.10.0 (network)
    • 192.168.10.1 through 192.168.10.3 (AWS reserved)
    • 192.168.10.255 (reserved)
  • VPC CIDR block size restrictions:
    • When creating a VPC you must choose a CIDR between /16 and /28.
    • Subnets must be subsets of that VPC CIDR. The smallest usable subnet size is /28 (16 IPs, with five reserved by AWS).
A diagram explaining VPC subnets and CIDR ranges, showing rules for subnet block sizes and reserved IP addresses (e.g., 192.168.10.0–192.168.10.3). It also shows example public subnets inside two availability zones with an overall CIDR of 192.168.0.0/16.

​
Additional subnet configuration rules and options

  • Subnets within the same VPC must not overlap. For example:
    • 10.16.0.0/24 and 10.16.0.128/25 overlap and cannot coexist in the same VPC.
  • Overlapping CIDR ranges are allowed across different VPCs (but be careful when peering or connecting VPCs — overlapping CIDRs can prevent routing between them).
  • IPv6 support:
    • You can assign an IPv6 CIDR block to a VPC and create IPv6 subnets.
    • Subnets can be IPv4-only, IPv6-only, or dual-stack (both IPv4 and IPv6), depending on your configuration.
  • Inter-subnet communication:
    • By default, all subnets within a VPC can route to each other (VPC routing allows full connectivity). Use security groups and Network ACLs to restrict traffic as needed.
  • Auto-assign public IP:
    • When enabled on a subnet, instances launched into that subnet receive an auto-assigned public IPv4 address (in addition to a private IP).
    • For internet-facing resources in a public subnet, enable auto-assign public IP and ensure the subnet’s route table points to an Internet Gateway.
Example AWS CLI commands:
  • Create a subnet:
  • Enable auto-assign public IPv4 on a subnet:
An infographic slide titled "Subnet Configuration Options" that lists subnet rules (no overlap, optional IPv6, inter-subnet communication) on the left. On the right is a diagram of a default VPC with public subnets in two availability zones and a sample CIDR (10.0.0.4/24).
Remember: each subnet is AZ-specific and must be within the VPC CIDR. AWS reserves the first four and the last IP address in every subnet, so plan your IP addressing accordingly.

​
Quick reference tables

​
Summary

  • Subnets are contiguous IP ranges inside a VPC used to place AWS resources.
  • Each subnet resides in a single Availability Zone — selecting a subnet determines the AZ for any launched resource.
  • Subnets can be public or private by configuring route tables and gateways (Internet Gateway, NAT Gateway).
  • Subnets must be subsets of the VPC CIDR and cannot overlap with other subnets in the same VPC.
  • AWS reserves the first four and the last IP address in every subnet; plan address allocations accordingly.
  • Subnets support IPv4, IPv6, or dual-stack configurations and can optionally auto-assign public IPs for internet-facing instances.

Watch Video