/22 subnet: 255.255.252.0, 1,024 addresses

A /22 has the netmask 255.255.252.0 and holds 1,024 addresses, 1,022 of them usable hosts. That’s four /24s in one block: 10.0.0.0/22 runs from 10.0.0.0 to 10.0.3.255, and only the first and last of those are reserved, so 10.0.1.0, 10.0.1.255 and 10.0.2.0 are ordinary hosts.

The numbers

Network        10.0.0.0/22
Broadcast      10.0.3.255
Netmask        255.255.252.0
Wildcard       0.0.3.255
First host     10.0.0.1
Last host      10.0.3.254

How it fits

A /16 holds 64 /22s and a /21 holds two. A /22 splits into 2 /23s, 4 /24s or 16 /26s. Its third octet starts on a multiple of 4: 10.0.0.0/22, 10.0.4.0/22, 10.0.8.0/22 and so on.

Where you’ll see it

• Subnets that hold pods. On EKS with the default VPC CNI, every pod takes an address from its node’s subnet, so pod-heavy clusters outgrow /24 subnets fast. /22 or larger private subnets give them room; AWS reserves 5 addresses in each, leaving 1,019.
• Large flat LANs. A guest Wi-Fi network or a building floor with several hundred clients fits in one /22, one DHCP scope and one VLAN, with no routing between its quarters.
• Public IPv4 in Europe. From 2012, when the RIPE NCC reached its last /8, until that pool ran out in November 2019, each member could get one /22. Many networks there started on exactly 1,024 public addresses.

Gotchas

• Start on a multiple of 4. 10.0.2.0/22 has host bits set and normalizes to 10.0.0.0/22. If you meant 10.0.2.0 to 10.0.5.255, no single block covers that range: it’s 10.0.2.0/23 plus 10.0.4.0/23.
• One broadcast domain. Up to 1,022 hosts share ARP and broadcast traffic. That’s fine for clients on Wi-Fi, but busy server networks are often split into /24s instead.
• Merging four /24s. Turning 10.0.0.0/24 through 10.0.3.0/24 into one /22 means every host, the DHCP scope and the router’s interface change mask to 255.255.252.0 together, and the four gateways collapse into one.

In your stack

# Terraform: the second /22 of a VPC, or two /22s and a /24 packed in order
cidrsubnet("10.0.0.0/16", 6, 1)              # "10.0.4.0/22"
cidrsubnets("10.0.0.0/16", 6, 6, 8)          # ["10.0.0.0/22", "10.0.4.0/22", "10.0.8.0/24"]
cidrnetmask("10.0.0.0/22")                   # "255.255.252.0"

import ipaddress
ipaddress.ip_network("10.0.0.0/24").supernet(new_prefix=22)   # IPv4Network('10.0.0.0/22')
ipaddress.ip_address("10.0.1.255") in ipaddress.ip_network("10.0.0.0/22")   # True

nft add rule inet filter forward ip saddr 10.0.0.0/22 oifname "wan0" accept