VPC address ranges

Every VPC has a range of private IPv4 addresses, and each resource you put in the VPC gets its private IP from that range. The range is written in CIDR notation, such as 10.20.0.0/23: the first part is where the range starts, and the number after the slash sets its size. The smaller that number, the more addresses the range holds.

You choose the range, and whether E2E or you sets it, when you create the VPC. It stays with the VPC for its whole life, so it is worth a minute of planning first.

E2E provided or custom

E2E provided IPv4 CIDR is the quick choice. E2E picks a free /23 range for you, which holds 512 addresses, and CDP Backup, Monitoring, Security Compliance, and Kubernetes all work with it. Take it when you want a private network for a handful of resources and have no address plan of your own to follow. For subnets, choose a custom range instead.

Custom CIDR lets you set the range yourself and split it into subnets. Choose it when the addresses matter to you, for example to group resources into subnets or to match a plan your team already uses. Keep resources that need CDP Backup, Monitoring, Security Compliance, or Kubernetes on an E2E provided range, the one those services work with.

Wherever another product lists your VPCs, such as the node or SFS create form, a VPC with an E2E provided range is marked Default, and one with a custom range Custom.

What a custom range can be

A custom range must be private and sit inside one of these two blocks:

• 10.0.0.0/8, addresses from 10.0.0.0 to 10.255.255.255
• 172.16.0.0/12, addresses from 172.16.0.0 to 172.31.255.255

The 192.168.0.0/16 block is private too, but E2E keeps it for its own use, so it is refused.

The size is from /16 to /28:

Size	Addresses
/16	65,536
/20	4,096
/23	512
/24	256
/28	16

The range must also start at its first address, and its last number must be 0. So 10.1.0.0/16 works, and 10.1.0.5/16 does not, because 10.1.0.5 is inside the range rather than at its start. A /28 range cannot be split into subnets, so pick /27 or larger if you plan to add them.

Addresses E2E keeps in every range

Your resources get most, but not all, of a range’s addresses. The network gateway takes the first address, such as 10.20.0.1 in 10.20.0.0/23, and E2E keeps the four addresses after it and the last four at the end of the range for the network itself. In a new VPC with the range 10.100.74.0/23, for example, the first node gets 10.100.74.6.

This matters most for subnets, because a subnet must leave out the addresses E2E keeps.

Planning subnets

A subnet is a smaller block inside a custom range, such as 10.10.0.128/25 inside 10.10.0.0/23. It must be smaller than the VPC’s range and no smaller than /28. A node you place in a subnet gets its private IP from that block, so web servers and databases, say, can sit on separate blocks of the same network.

Because E2E keeps addresses at both ends of the range, subnets come from the blocks between the first and the last. Here is 10.10.0.0/23 split into four /25 blocks:

Block	Can be a subnet
10.10.0.0/25	No, it holds the addresses at the start
10.10.0.128/25	Yes
10.10.1.0/25	Yes
10.10.1.128/25	No, it holds the addresses at the end

So when you size a VPC, leave room at both ends: a VPC that needs two /25 subnets needs at least a /23 range.

Ranges for peering

Resources in two peered VPCs reach each other by address, so the two ranges must not overlap. If both VPCs contain 10.20.0.10, the route to the other VPC cannot tell which one you mean. E2E provided ranges never overlap each other. When you set custom ranges, give each VPC its own block, such as 10.20.0.0/23 for one and 10.30.0.0/23 for the next, and keep them clear of any office or other-cloud network you plan to connect as well.

To create a VPC with the range you have planned, see Create a VPC. To split it, see Create a subnet.