AWS VPC & Subnet

VPC Peering Limitations

• https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html#vpc-peering-limitations

VPC deep dive

• main route table is implicitly associate with subnets that haven't been explicitly associated with a route table

VPC/Subnet Optimize

Public subnet for NAT gateway doesn't need too much IP range(CIDR block)

because it's only for the proxy to the private subnet.

so for making a public subnet for NAT gateway /30 the subnet mask would be best.

because /30 IP range is 2

but AWS VPC & Subnet do not allow /30 you should do /28 that's best for optimizing CIDR block

The subnet CIDR block size can be from /16 to /28. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html

https://findnerd.com/list/view/IPv4---Subnetting/17509/

so if you set 10.0.0.0/28 then you will get IP range 10.0.0.0 - 10.0.0.15

if you want multiple IP private subnet IP range maybe you can start

10.0.255.0 and assign then

• 10.0.255.0 / 28 -> 10.0.255.0 ~ 10.0.255.15

• 10.0.255.16 / 28 -> 10.0.255.16 ~ 10.0.255.31

• 10.0.255.32 / 28 -> 10.0.255.32 ~ 10.0.255.47

• ...

• 10.0.255.128 / 28 -> 10.0.255.128 ~ 10.0.255.143

• ...

you can get 16 private subnets for NAT gateway from 10.0.255.x

CIDR Block Strategy

Architecture - Building a Modular and Scalable Virtual Network Architecture with Amazon VPCBuilding a Modular and Scalable Virtual Network Architecture with Amazon VPC

When you create VPC 10.x.0.0 /16

you can split /20 bitmask, then you will be able to make 16 subnet that has 4094 IP address

but don't chuck everything with /20 bitmask,

chuck 12 subnets with /20 mask with 10.x.0.0/20 ~ 10.x.175.0 /20 then you will use 10.x.0.0 ~ 10.x.191.255

Count	IP Address	Purpose	Mask Bits	CIDR Address Range	Total IP Address (should -5)
1	10.x.0.0	subnet	20	10.x.0.0 - 10.x.15.255
2	10.x.16.0	subnet	20	10.x.16.0 - 10.x.31.255
3	10.x.32.0	subnet	20	10.x.32.0 - 10.x.47.255
4	10.x.48.0	subnet	20	10.x.48.0 - 10.x.63.255
5	10.x.64.0	subnet	20	10.x.64.0 - 10.x.79.255
6	10.x.80.0	subnet	20	10.x.80.0 - 10.x.95.255
7	10.x.96.0	subnet (private)	20	10.x.96.0 - 10.x.111.255
8	10.x.112.0	subnet (private)	20	10.x.112.0 - 10.x.127.255
9	10.x.128.0	subnet (private)	20	10.x.128.0 - 10.x.143.255
10	10.x.144.0	subnet (private)	20	10.x.144.0 - 10.x.159.255
11	10.x.160.0	subnet (private)	20	10.x.160.0 - 10.x.175.255
12	10.x.176.0	subnet (private)	20	10.x.176.0 - 10.x.191.255
	10.x.192.0	subnet - spare	20	10.x.192.0 - 10.x.207.255
	10.x.208.0	subnet - spare	20	10.x.208.0 - 10.x.225.255
	10.x.226.0	subnet - spare	20	10.x.226.0 - 10.x.241.255
	10.x.242.0 /28 10.x.242.16 /28 10.x.242.32 /28 ... 10.x.255.0 /28	split subnet for NAT	each /28	10.x.242.0 - 10.x..255

IP address will be -5 always.

https://docs.aws.amazon.com/vpc/latest/userguide/subnet-sizing.html

The first four IP addresses and the last IP address in each subnet CIDR block are not available for you to use, and cannot be assigned to an instance. For example, in a subnet with CIDR block 10.0.0.0/24, the following five IP addresses are reserved:

• 10.0.0.0: Network address.

• 10.0.0.1: Reserved by AWS for the VPC router.

• 10.0.0.2: Reserved by AWS. The IP address of the DNS server is the base of the VPC network range plus two. For VPCs with multiple CIDR blocks, the IP address of the DNS server is located in the primary CIDR. We also reserve the base of each subnet range plus two for all CIDR blocks in the VPC. For more information, see Amazon DNS server.

• 10.0.0.3: Reserved by AWS for future use.

• 10.0.0.255: Network broadcast address. We do not support broadcast in a VPC, therefore we reserve this address.

The reason why orient /20 with 4094 range

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-quotas.html

Service quota	Description	Default quota value	Adjustable
Fargate On-Demand resource count	The maximum number of Amazon ECS tasks and Amazon EKS pods running concurrently on Fargate in this account in the current Region.	1,000	Yes
Fargate Spot resource count	The maximum number of Amazon ECS tasks running concurrently on Fargate Spot in this account in the current Region.	1,000	Yes

Fargate Task use 1 private address

By default, every Amazon ECS task on Fargate is provided an elastic network interface (ENI) with a primary private IP address. https://docs.aws.amazon.com/AmazonECS/latest/userguide/fargate-task-networking.html

Subnet network bit prefix rules for usual service

	Subnets	Hosts/Subnet
10.x.0.0/20	4096	4094
10.x.16.0/20	4096	4094
10.x.32.0/20	4096	4094

IP 할당이 많이 필요한 경우는 prefix 16까지 해도 됨.

10.0.0.0./16 로 할경우

CIDR range 10.0.0.0 - 10.0.255.255

IP개수는 65534가 됨. 메세징 서버같은 특별한 경우는

10.128.0.0 부터 prefix 12로 해도 됨.

CIDR range 10.128.0.0 - 10.143.255.255 = IP 1,048,574

• https://www.subnet-calculator.com/cidr.php

https://findnerd.com/list/view/IPv4---Subnetting/17509/

https://www.google.com/search?q=class+a+b+c+subnets&rlz=1C5CHFA_enKR965KR965&sxsrf=APq-WBtoF_-dbzmuPPY2SdQ8nW41WLF7Vg:1645507963366&source=lnms&tbm=isch&sa=X&ved=2ahUKEwi0k4btypL2AhVJEXAKHYHqCa4Q_AUoAXoECAEQAw&biw=1430&bih=1356&dpr=2.5#imgrc=XjgxGFxjfq1M7M

Reference

• RFC 1918 - Address Allocation for Private Internets

3. Private Address Space

   The Internet Assigned Numbers Authority (IANA) has reserved the
   following three blocks of the IP address space for private internets:

     10.0.0.0        -   10.255.255.255  (10/8 prefix)
     172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
     192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

• https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml#iana-ipv4-special-registry-1

Address Block	Name	RFC	Allocation Date	Termination Date	Source	Destination	Forwardable	Globally Reachable	Reserved-by-Protocol
0.0.0.0/8	"This network"	[RFC791], Section 3.2	1981-09	N/A	True	False	False	False	True
0.0.0.0/32	"This host on this network"	[RFC1122], Section 3.2.1.3	1981-09	N/A	True	False	False	False	True
10.0.0.0/8	Private-Use	[RFC1918]	1996-02	N/A	True	True	True	False	False
100.64.0.0/10	Shared Address Space	[RFC6598]	2012-04	N/A	True	True	True	False	False
127.0.0.0/8	Loopback	[RFC1122], Section 3.2.1.3	1981-09	N/A	False [1]	False [1]	False [1]	False [1]	True
169.254.0.0/16	Link Local	[RFC3927]	2005-05	N/A	True	True	False	False	True
172.16.0.0/12	Private-Use	[RFC1918]	1996-02	N/A	True	True	True	False	False
192.0.0.0/24 [2]	IETF Protocol Assignments	[RFC6890], Section 2.1	2010-01	N/A	False	False	False	False	False
192.0.0.0/29	IPv4 Service Continuity Prefix	[RFC7335]	2011-06	N/A	True	True	True	False	False
192.0.0.8/32	IPv4 dummy address	[RFC7600]	2015-03	N/A	True	False	False	False	False
192.0.0.9/32	Port Control Protocol Anycast	[RFC7723]	2015-10	N/A	True	True	True	True	False
192.0.0.10/32	Traversal Using Relays around NAT Anycast	[RFC8155]	2017-02	N/A	True	True	True	True	False
192.0.0.170/32, 192.0.0.171/32	NAT64/DNS64 Discovery	[RFC8880][RFC7050], Section 2.2	2013-02	N/A	False	False	False	False	True
192.0.2.0/24	Documentation (TEST-NET-1)	[RFC5737]	2010-01	N/A	False	False	False	False	False
192.31.196.0/24	AS112-v4	[RFC7535]	2014-12	N/A	True	True	True	True	False
192.52.193.0/24	AMT	[RFC7450]	2014-12	N/A	True	True	True	True	False
192.88.99.0/24	Deprecated (6to4 Relay Anycast)	[RFC7526]	2001-06	2015-03
192.168.0.0/16	Private-Use	[RFC1918]	1996-02	N/A	True	True	True	False	False
192.175.48.0/24	Direct Delegation AS112 Service	[RFC7534]	1996-01	N/A	True	True	True	True	False
198.18.0.0/15	Benchmarking	[RFC2544]	1999-03	N/A	True	True	True	False	False
198.51.100.0/24	Documentation (TEST-NET-2)	[RFC5737]	2010-01	N/A	False	False	False	False	False
203.0.113.0/24	Documentation (TEST-NET-3)	[RFC5737]	2010-01	N/A	False	False	False	False	False
240.0.0.0/4	Reserved	[RFC1112], Section 4	1989-08	N/A	False	False	False	False	True
255.255.255.255/32	Limited Broadcast	[RFC8190] [RFC919], Section 7	1984-10	N/A	False	True	False	False	True