Guide

Linux and networking

CIDR and VPC basics

A VPC is an isolated address space. CIDR notation says how big each part of it is. Plan the ranges before you create anything, because overlaps are hard to undo.

17 of 162 · 2 min read

A VPC (virtual private cloud, or VPC network on GCP) is an isolated pool of IP addresses in one region. You carve subnets out of it, and instances, load balancers and many managed services get their addresses from those subnets. Before you create anything, decide how that address pool will be split.

Concept

A CIDR block writes a range as address/prefix, such as 10.0.0.0/16. The prefix says how many leading bits are fixed. The rest are free for hosts. A /16 has 2^16 = 65,536 addresses. A /24 has 2^8 = 256.

The big idea

Think of a CIDR block as a street address with a fixed postcode. 10.0.0.0/16 is the whole postcode area. A /20 is a neighbourhood inside it, and each neighbourhood holds 4,096 addresses. The analogy breaks when two companies use the same postcode. Their addresses collide, and no route can tell them apart.

Walking through a plan

Here is a plan for one production network in one region. Each row is a block of addresses.

NetworkExample CIDRNotes
Prod VPC10.16.0.0/16One /16 per environment per region is a common start
Staging VPC10.32.0.0/16Kept apart from prod, so they can be peered later
Public subnets10.16.0.0/20, 10.16.16.0/20, ...One per zone. Load balancers and NAT only
Private app10.16.64.0/20, ...Application hosts and Kubernetes nodes
Private data10.16.128.0/20, ...Databases and caches

Count the addresses for the private app tier. A /20 holds 4,096 addresses. Three zones of /20 subnets give 3 × 4,096 = 12,288 addresses for app hosts. That is plenty for nodes, but Kubernetes pods often need their own, larger ranges, so plan those separately.

In AWS, a subnet lives in exactly one zone. High availability means subnets in at least two zones, and three is better for quorum systems. GCP subnets are regional and span zones.

Common mistakes

  • Choosing 10.0.0.0/16 everywhere. Two VPCs with the same range cannot be peered.
  • Carving /24 subnets until the space runs out. Leave headroom from the start. Renumbering a live VPC means a new VPC and a migration.
  • Forgetting pod addresses. Kubernetes pods can need far more addresses than the node subnet.

Check yourself

  1. How many addresses does a /16 contain? Answer: 65,536, because 2^(32 − 16) = 2^16.
  2. Why can't two VPCs that both use 10.0.0.0/16 be peered? Answer: Routes would point at the same addresses in both networks, so the router cannot tell which network an address belongs to.

Key takeaways

  • A CIDR prefix sets the size of a range. Smaller prefix number, bigger range.
  • Plan the whole address space before creating networks, and leave headroom.
  • Use one subnet per zone per tier, so a zone failure removes one subnet, not a whole tier.
  • Plan Kubernetes pod ranges separately, since they are often much larger than node ranges.

Further learning

Next, see how a packet chooses its next hop once the subnets exist: routes, internet gateways and NAT.

Networking: IP, TCP and UDP

Packets, addresses, ports, and the handshakes and congestion control that decide how fast your bytes arrive. Explains why a new connection is slow and how to check it on the wire.

Cloud networking and VPCs

VPCs, subnets, routing, NAT, security groups and private connectivity in AWS and GCP, plus a three-AZ reference architecture and how to debug when A cannot reach B.

Routes, internet gateways and NAT

A route table picks the next hop for each packet. Public subnets reach the internet through a gateway. Private subnets get outbound access through NAT, and endpoints skip NAT for cloud APIs.