Which IPv4 Addresses Are Reserved in an AWS Subnet?

Amazon Web Services reserves five specific IPv4 addresses within every Virtual Private Cloud subnet to manage essential networking functions such as routing, domain name resolution, and network broadcasting. Specifically, the first four IP addresses and the very last IP address in any subnet CIDR block are locked by AWS and cannot be assigned to Amazon EC2 instances or other user resources. Understanding how these reserved addresses operate is vital for cloud architects and network engineers when calculating available IP capacity and designing scalable cloud architectures.

Breakdown of the Five Reserved IPv4 Addresses

To illustrate how AWS allocates these five addresses, consider a standard subnet created with the CIDR block 10.0.0.0/24. In this subnet, the total IP address range spans from 10.0.0.0 to 10.0.0.255. Out of these addresses, AWS automatically reserves the following five locations:

  • 10.0.0.0 (First Address - Network Address): This is the base network identifier for the subnet. In standard IPv4 networking, the first address in a CIDR block defines the network segment itself and cannot be assigned to an individual host.
  • 10.0.0.1 (Second Address - VPC Router): AWS reserves the second IP address in every subnet for the intrinsic VPC router. This virtual router handles all traffic routing between different subnets within the VPC, as well as traffic heading to internet gateways, NAT gateways, and virtual private gateways.
  • 10.0.0.2 (Third Address - AWS DNS): The third address is reserved for the Amazon-provided DNS server. Although the main VPC DNS resolver is always accessible at the base VPC network range plus two, each individual subnet reserves its own .2 address to facilitate internal domain name resolution.
  • 10.0.0.3 (Fourth Address - Future Use): AWS sets aside the fourth address in every subnet for future networking features and internal service enhancements. It remains completely unavailable for customer assignment.
  • 10.0.0.255 (Last Address - Network Broadcast Address): The final IP address in the CIDR block is reserved as the network broadcast address. Even though Amazon VPC does not support broadcast traffic within a virtual network, AWS still reserves this address to adhere to standard IPv4 subnetting conventions.

Calculating Usable IP Addresses in an AWS Subnet

In traditional on-premises networking, only two IP addresses per subnet are unusable by hosts: the network address and the broadcast address. Because AWS claims three additional addresses for its managed infrastructure, your capacity calculations must account for five unavailable IPs per subnet instead of two.

For a given subnet with a prefix length of \(n\) (such as \(/24\)), the number of host bits is \(32 - n\). You can calculate the exact number of usable IPv4 addresses available for EC2 instances using the following formula:

\[\text{Usable IPs} = 2^{32 - n} - 5\]

Using the /24 subnet example where \(n = 24\), the calculation works out to:

\[\text{Usable IPs} = 2^{32 - 24} - 5 = 2^8 - 5 = 256 - 5 = 251\]

Usable Capacity Across Common Subnet Sizes

When planning your VPC layout, choosing the right subnet size ensures you do not run out of IP addresses as your auto-scaling groups, load balancers, and Elastic Network Interfaces expand. The impact of the five reserved addresses is much more noticeable in smaller subnets than in larger ones:

  • /28 Subnet (Smallest supported by AWS): Contains \(2^{32 - 28} = 16\) total IP addresses. After subtracting the 5 reserved addresses, only 11 usable IPs remain.
  • /27 Subnet: Contains \(2^{32 - 27} = 32\) total IP addresses, leaving 27 usable IPs.
  • /26 Subnet: Contains \(2^{32 - 26} = 64\) total IP addresses, leaving 59 usable IPs.
  • /25 Subnet: Contains \(2^{32 - 25} = 128\) total IP addresses, leaving 123 usable IPs.
  • /24 Subnet: Contains \(2^{32 - 24} = 256\) total IP addresses, leaving 251 usable IPs.
  • /16 Subnet (Largest supported by AWS): Contains \(2^{32 - 16} = 65,536\) total IP addresses, leaving 65,531 usable IPs.

Considerations for Non-Zero Boundary Subnets

While the 10.0.0.0/24 example uses convenient numbers ending in .0, .1, .2, .3, and .255, smaller subnets or subnets split on different boundaries follow the exact same positional rule rather than the literal ending digits.

For example, if you provision a /28 subnet with the CIDR block 10.0.0.16/28, the IP range spans from 10.0.0.16 to 10.0.0.31. In this specific subnet, the five reserved addresses are:

  • 10.0.0.16 (Network Address)
  • 10.0.0.17 (VPC Router)
  • 10.0.0.18 (AWS DNS)
  • 10.0.0.19 (Future Use)
  • 10.0.0.31 (Network Broadcast Address)

In this /28 block, the first assignable IP address for an Amazon EC2 instance is 10.0.0.20, and the last assignable IP address is 10.0.0.30. Always evaluate the start and end boundaries of your specific CIDR block to identify which exact IP addresses are reserved by AWS.