/26 subnet: 255.255.255.192, 64 addresses

A /26 has the netmask 255.255.255.192 and holds 64 addresses, 62 of them usable hosts. It’s a quarter of a /24, so its last octet starts at .0, .64, .128 or .192. 10.0.1.64/26 runs from 10.0.1.64, its network address, to 10.0.1.127, its broadcast address.

The numbers

Network        10.0.1.64/26
Broadcast      10.0.1.127
Netmask        255.255.255.192
Wildcard       0.0.0.63
First host     10.0.1.65
Last host      10.0.1.126

How it fits

A /24 holds four /26s and a /16 holds 1,024. A /26 splits into 2 /27s or 4 /28s.

Where you’ll see it

• Azure’s named subnets. Azure Firewall goes in a /26 subnet named AzureFirewallSubnet, and Azure Bastion in one named AzureBastionSubnet that’s /26 or larger. Both services refuse a subnet with any other name.
• Calico’s IPAM blocks. Calico hands pod addresses to each node in blocks, /26 by default (blockSize: 26), so a node starts with 64 addresses and takes another block when it fills one.

What the cloud keeps

AWS and Azure reserve the first four addresses and the last one of every subnet; Google Cloud reserves the first two and the last two. In 10.0.1.64/26:

AWS, Azure     .64  .65  .66  .67  .127     59 usable, .68 to .126
Google Cloud   .64  .65  .126 .127          60 usable, .66 to .125

Gotchas

• Blocks run out with nodes. A /16 holds 1,024 /26s, so Calico’s default 192.168.0.0/16 pool has 1,024 blocks to hand out. A cluster that may grow past that many nodes needs a bigger pool or smaller blocks.
• Calico’s block size is set when the pool is created. Changing blockSize later means creating a new IP pool and moving workloads to it, so pick it with the cluster’s pods per node in mind.

In your stack

# Terraform: the second /26 of 10.0.1.0/24, as Azure Bastion's subnet
cidrsubnet("10.0.1.0/24", 2, 1)          # "10.0.1.64/26"

resource "azurerm_subnet" "bastion" {
  name                 = "AzureBastionSubnet"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.1.64/26"]
}

apiVersion: projectcalico.org/v3
kind: IPPool
metadata:
  name: default-ipv4-ippool
spec:
  cidr: 192.168.0.0/16
  blockSize: 26
  natOutgoing: true

! Cisco ACL for the block, with its wildcard
access-list 20 permit 10.0.1.64 0.0.0.63