/30 subnet: 255.255.255.252, 4 addresses

A /30 has the netmask 255.255.255.252 and holds 4 addresses, of which only 2 are usable hosts: 10.0.0.0/30 has network 10.0.0.0, hosts 10.0.0.1 and 10.0.0.2, and broadcast 10.0.0.3. Two hosts is what a link between two routers needs, and that’s what /30s are mostly used for.

The numbers

Network        10.0.0.0/30
Broadcast      10.0.0.3
Netmask        255.255.255.252
Wildcard       0.0.0.3
First host     10.0.0.1
Last host      10.0.0.2

How it fits

A /24 holds 64 /30s and a /29 holds two. A /30 splits into 2 /31s or 4 /32s.

Where you’ll see it

• Point-to-point links. WAN circuits, router-to-router links and GRE or IPsec tunnels have long been numbered with /30s, one host address for each end.
• AWS Site-to-Site VPN. Each tunnel’s inside addresses are a /30 from 169.254.0.0/16. In 169.254.10.0/30, AWS’s side takes 169.254.10.1, your customer gateway takes 169.254.10.2, and BGP runs between them.

/30 or /31

Half of every /30 is overhead. RFC 3021 lets a point-to-point link use a /31 instead, with no network or broadcast address, so the same 4 addresses number two links: the tool below splits 10.0.0.0/30 into 10.0.0.0/31 and 10.0.0.2/31. Cisco IOS, Junos and Linux all accept /31s. A /30 is still the safe choice when the other end is a provider’s equipment you don’t control, or software that assumes every subnet loses two addresses.

Gotchas

• Both ends must agree. One side on /30 and the other on /31 disagree about which addresses are hosts: 10.0.0.0 is the network address to one and a neighbor to the other.
• Mind the boundaries. /30s in a /24 start at every multiple of 4, so links use .1/.2, .5/.6, .9/.10 and so on. A router given .3 or .4 is on a broadcast or network address.

In your stack

! Cisco IOS: the link and its OSPF statement, with the /30 wildcard
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.252
router ospf 1
 network 10.0.0.0 0.0.0.3 area 0

ip addr add 10.0.0.2/30 dev eth1        # Linux, the other end

# Terraform: the first two /30s of a /24, and an AWS VPN with its tunnel addresses
cidrsubnets("10.0.0.0/24", 6, 6)        # ["10.0.0.0/30", "10.0.0.4/30"]

resource "aws_vpn_connection" "office" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.office.id
  type                = "ipsec.1"
  tunnel1_inside_cidr = "169.254.10.0/30"
  tunnel2_inside_cidr = "169.254.10.4/30"
}