--- title: "VPC address ranges" description: "Which private address ranges a VPC can have, the addresses E2E keeps in each one, and how to plan subnets and ranges for peering." content_type: "concept" product: "vpc" platform: "MyAccount" url: "/myaccount/vpc/concepts/vpc-address-ranges/" --- # VPC address ranges Every VPC has a range of private IPv4 addresses, and each resource you put in the VPC gets its private IP from that range. The range is written in CIDR notation, such as `10.20.0.0/23`: the first part is where the range starts, and the number after the slash sets its size. The smaller that number, the more addresses the range holds. You choose the range, and whether E2E or you sets it, when you create the VPC. It stays with the VPC for its whole life, so it is worth a minute of planning first. ## E2E provided or custom **E2E provided IPv4 CIDR** is the quick choice. E2E picks a free `/23` range for you, which holds 512 addresses, and CDP Backup, Monitoring, Security Compliance, and Kubernetes all work with it. Take it when you want a private network for a handful of resources and have no address plan of your own to follow. For subnets, choose a custom range instead. **Custom CIDR** lets you set the range yourself and split it into subnets. Choose it when the addresses matter to you, for example to group resources into subnets or to match a plan your team already uses. Keep resources that need CDP Backup, Monitoring, Security Compliance, or Kubernetes on an E2E provided range, the one those services work with. Wherever another product lists your VPCs, such as the node or SFS create form, a VPC with an E2E provided range is marked **Default**, and one with a custom range **Custom**. ## What a custom range can be A custom range must be private and sit inside one of these two blocks: - `10.0.0.0/8`, addresses from `10.0.0.0` to `10.255.255.255` - `172.16.0.0/12`, addresses from `172.16.0.0` to `172.31.255.255` The `192.168.0.0/16` block is private too, but E2E keeps it for its own use, so it is refused. The size is from `/16` to `/28`: | Size | Addresses | | ----- | --------- | | `/16` | 65,536 | | `/20` | 4,096 | | `/23` | 512 | | `/24` | 256 | | `/28` | 16 | The range must also start at its first address, and its last number must be `0`. So `10.1.0.0/16` works, and `10.1.0.5/16` does not, because `10.1.0.5` is inside the range rather than at its start. A `/28` range cannot be split into subnets, so pick `/27` or larger if you plan to add them. ## Addresses E2E keeps in every range Your resources get most, but not all, of a range's addresses. The network gateway takes the first address, such as `10.20.0.1` in `10.20.0.0/23`, and E2E keeps the four addresses after it and the last four at the end of the range for the network itself. In a new VPC with the range `10.100.74.0/23`, for example, the first node gets `10.100.74.6`. This matters most for subnets, because a subnet must leave out the addresses E2E keeps. ## Planning subnets A subnet is a smaller block inside a custom range, such as `10.10.0.128/25` inside `10.10.0.0/23`. It must be smaller than the VPC's range and no smaller than `/28`. A node you place in a subnet gets its private IP from that block, so web servers and databases, say, can sit on separate blocks of the same network. Because E2E keeps addresses at both ends of the range, subnets come from the blocks between the first and the last. Here is `10.10.0.0/23` split into four `/25` blocks: | Block | Can be a subnet | | ---------------- | --------------------------------------- | | `10.10.0.0/25` | No, it holds the addresses at the start | | `10.10.0.128/25` | Yes | | `10.10.1.0/25` | Yes | | `10.10.1.128/25` | No, it holds the addresses at the end | So when you size a VPC, leave room at both ends: a VPC that needs two `/25` subnets needs at least a `/23` range. ## Ranges for peering Resources in two peered VPCs reach each other by address, so the two ranges must not overlap. If both VPCs contain `10.20.0.10`, the route to the other VPC cannot tell which one you mean. E2E provided ranges never overlap each other. When you set custom ranges, give each VPC its own block, such as `10.20.0.0/23` for one and `10.30.0.0/23` for the next, and keep them clear of any office or other-cloud network you plan to connect as well. To create a VPC with the range you have planned, see [Create a VPC](/myaccount/vpc/how-to/create-a-vpc/). To split it, see [Create a subnet](/myaccount/vpc/how-to/create-a-subnet/).