/28 subnet: 255.255.255.240, 16 addresses

A /28 has the netmask 255.255.255.240 and holds 16 addresses, 14 of them usable hosts. A /24 holds sixteen of them, one starting at every multiple of 16 in the last octet; 10.0.0.16/28 runs from 10.0.0.16 to 10.0.0.31.

The numbers

Network        10.0.0.16/28
Broadcast      10.0.0.31
Netmask        255.255.255.240
Wildcard       0.0.0.15
First host     10.0.0.17
Last host      10.0.0.30

How it fits

A /24 holds 16 /28s and a /16 holds 4,096. A /28 splits into 2 /29s or 4 /30s.

Where you’ll see it

• The floor on AWS. /28 is the smallest CIDR AWS accepts for a VPC or a subnet. With 5 addresses reserved, 10.0.0.16/28 keeps 11: AWS takes .16 (network), .17 (the VPC router), .18 (DNS), .19 (reserved for future use) and .31 (broadcast), leaving .20 to .30.
• Transit Gateway attachments. AWS recommends a separate small subnet, such as a /28, in each availability zone for a VPC’s Transit Gateway attachment, which keeps more of the VPC for workloads.
• GKE private clusters. The control plane’s range, --master-ipv4-cidr, must be a /28 that doesn’t overlap anything else in the VPC network.

Gotchas

• Too small for some services. An AWS Application Load Balancer needs subnets of /27 or larger, and services that place interfaces in your subnets, such as the EKS control plane, need free addresses there during upgrades. Keep /28s for things that stay the same size.
• No room to grow. An AWS subnet’s CIDR can’t be changed after it’s created; the fix for a full /28 is a new, bigger subnet and a migration.
• Count the 11. Of the 11 addresses AWS leaves, each instance interface, NAT gateway, interface endpoint and load balancer takes at least one.

In your stack

# Terraform: the second /28 of a VPC, as a Transit Gateway attachment subnet
cidrsubnet("10.0.0.0/16", 12, 1)          # "10.0.0.16/28"
cidrhost("10.0.0.16/28", 4)               # "10.0.0.20", the first address AWS leaves you

resource "aws_subnet" "tgw_a" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.0.16/28"
  availability_zone = "us-east-1a"
}

gcloud container clusters create private-1 \
  --enable-ip-alias --enable-private-nodes --master-ipv4-cidr 172.16.0.32/28