J jhooq.com / tools

VPC Subnet Planner

Design a multi-zone network the way it should be designed - see the whole address space as a map, let the planner pack and align every subnet, check it against the networks you already have, and leave with Terraform, CloudFormation, Azure CLI or gcloud you can run. Nothing leaves your browser.

AWS · Azure · GCP reserved addressesTier summary blocksOverlap checkDesign reviewTerraform cidrsubnet() derivationShareable linkNo upload, no sign-up

1. Cloud and address space

Cloud

Network CIDR

Availability Zones

Reserve space for one more zone later

2. Tiers

Size by prefix or by hosts needed - the planner picks the smallest prefix that fits the hosts plus the cloud's reserved addresses and your growth headroom.

3. Layout rules

Keep each tier contiguous (one summary block per tier)

Growth headroom for host-sized tiers

% extra hosts before rounding up

Existing networks to avoid (one CIDR per line)

Peering and Transit Gateway refuse overlapping ranges. Paste the ranges of every VPC, VNet, on-prem site and partner you connect to.

Address map

Zone layout

Design review

Subnet table

Export

Copy, download, run.

Include routing (IGW, NAT per zone, route tables)

How the planner works

You give the planner one network range, the number of zones and a list of tiers. It sizes every subnet (by the prefix you choose, or by the number of hosts you need plus growth headroom and the cloud's reserved addresses), places the subnets largest first on aligned boundaries so that no two overlap and the leftover space stays in clean CIDR blocks, keeps each tier in one contiguous block so a single summary route or firewall rule can cover it, and then reviews the result against the rules below. The whole thing runs in your browser; the share link encodes your inputs in the URL, nothing is sent to a server.

Reserved addresses per subnet - why a /24 is not 254 hosts

Cloud	Reserved	Which addresses	Smallest subnet	Usable hosts in a /24
AWS	5	network, VPC router (.1), Amazon DNS (.2), future use (.3), broadcast (last)	/28 (11 usable)	251
Azure	5	network, default gateway (.1), Azure DNS (.2 and .3), broadcast (last)	/29 (3 usable)	251
Google Cloud	4	network, default gateway (.1), second-to-last (future use), broadcast (last)	/29 (4 usable)	252
Generic IPv4	2	network, broadcast	/30 (2 usable)	254

Sources: AWS subnet sizing, Azure virtual network FAQ, Google Cloud subnets.

The design rules it checks

Private address space. The network must sit inside 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16 (100.64.0.0/10 is accepted with a warning). Public ranges such as 11.0.0.0/16 work inside a VPC but break reachability to real hosts and fail compliance reviews.
Alignment. Every subnet starts on a multiple of its own size; the typed address is snapped to the correct network address.
Cloud limits. AWS VPCs are /16 to /28 and subnets no smaller than /28; Azure and Google Cloud allow /29.
Load balancer minimums. An AWS Application Load Balancer needs at least 8 free addresses per subnet (a /27 or larger) in two zones; the planner warns on smaller public tiers.
Zones. One subnet per tier per zone; two zones are the minimum for load balancers and Multi-AZ databases, three is the production norm, and reserving a slot for a future zone is free today and expensive later.
Headroom. Plans above 95 percent allocation get a warning; the free space is listed as aligned CIDR blocks so that a new tier can take one without renumbering.
Overlap. VPC peering and Transit Gateway refuse overlapping CIDRs; the planner checks your network against every range you list and suggests free alternatives of the same size.
Cost. One NAT gateway per zone is the resilient layout; the review shows the monthly estimate (about $0.045 per hour per gateway plus $0.045 per GB) and reminds you that gateway endpoints for S3 and DynamoDB are free.

Frequently asked questions

How many usable IP addresses does a /24 subnet have on AWS?
251. AWS reserves the first four addresses and the last address of every subnet, so a /24 (256 addresses) leaves 251 for your resources. Azure also reserves 5 (251 usable); Google Cloud reserves 4 (252 usable).

What is the smallest subnet I can create?
/28 on AWS (16 addresses, 11 usable), /29 on Azure (8 addresses, 3 usable) and /29 on Google Cloud (8 addresses, 4 usable).

Which CIDR should I use for a new VPC?
A /16 from a private range that no other network in your organisation uses - for example 10.10.0.0/16 for the first VPC, 10.11.0.0/16 for the next. Keep an inventory, because peering and Transit Gateway cannot connect networks whose ranges overlap.

How big should subnets be for an EKS cluster?
With the Amazon VPC CNI every pod takes an address from the subnet, so plan nodes multiplied by pods per node per zone; a /19 per zone (8,187 usable) is a common starting point, and prefix delegation stretches it about 16 times. Overlay CNIs on AKS and GKE take pod addresses from a separate range, so only nodes consume subnet addresses.

Why keep each tier contiguous?
If all private subnets live inside one /18, a single route, network ACL rule or firewall rule can match "all private subnets" instead of one rule per zone. It also makes future zones a matter of filling the reserved slot.

Does the tool upload my network design?
No. The planner is a single page that runs entirely in your browser. The share link stores your inputs in the URL fragment, which browsers never send to the server.

Can I trust the Terraform it generates?
The export declares every subnet with cidrsubnet() so the addresses can be verified from the VPC CIDR, and the generated configuration is validated against the current AWS provider. Review the routing choices (NAT gateway per zone, isolated route table for databases, S3 gateway endpoint) before you apply, and add security groups and NACLs yourself.