When i try to add a new subnet in my VPC I get this message: CIDR is not within the CIDR ranges of VPC.

My current VPC CIDR is

Any help?

  • Hi, if the response below answered your question please upvote and accept it. That's the ServerFault way of saying Thanks for the time someone took to help you :) – MLu Feb 19 at 20:55

The best start is to refer to VPC and Subnet Basics which explains the VPC addressing and sizing reqirements.

Not sure if you are familiar with CIDR addressing? Essentially the bigger the number after / the less hosts and subnets you can fit inside such network.

For example:

  • Your VPC CIDR is where /28 means that out of the 32 bits in the IP address the first 28 bits are the network address (that part has to be the same for all resources in your VPC) and only the remaining 4 bits (= 32 - 28) can be used to address your instances.

    That gives you at most 24 = 16 IP addresses in your subnet. With 5 IPs reserved by AWS you can only use 11 IP addresses.

  • Also because the minimum subnet size is /28 you can really create only one subnet in your /28 VPC and it has to have the same CIDR range, i.e.

    That effectively prevents you from placing your instances in multiple availability zones because subnets can not span across AZs.

Much better practice is to allocate rather large CIDR blocks for your VPC. At least /24 but even larger if you can. Where larger means /22 or /20 or even /16. That will give you an opportunity to create subnets in multiple availability zones and create both private and public (DMZ) subnets.

In your case you can allocate to the VPC and then create 4 subnets inside the VPC:

  • Public A = (in Availability zone a, e.g. ap-southeast-2a)
  • Public B = (in AZ b, e.g. ap-southeast-2b)
  • Private A = (in AZ a again)
  • Private B = (in AZ b again)

That will give you around 60 IP addresses in each subnet and you can have some hosts in Private subnets and some in Public, you can balance load across availability zones, etc.

If you want to go one step higher and allocate to your VPC the addressing then would be like this:

  • VPC CIDR =
  • Public A =
  • Public B =
  • Private A =
  • Private B =

For the difference between Public and Private subnets refer to this answer: NAT gateway for ec2 instances

Hope that helps :)

  • @omarjalloh I'm glad I could help :) If you're happy with the answer please upvote and accept it. Thanks! – MLu Jan 8 at 21:42

The subnet you're trying to add is

  1. not within your VPC's IP range
  2. bigger than your VPC's IP range

As such, you can't add it.

Side note: I didn't know AWS would even let you make a /28 VPC. You'll only have fourteen usable IPs in there.

  • Ok, any ideas what subnet range I can use? – omar jalloh Jan 7 at 19:42
  • 2
    @omarjalloh You should delete the VPC and start over. A /28 is way too small for virtually any use case on AWS. – ceejayoz Jan 7 at 19:44
  • You can use /16 to /28 in AWS. A /28 is appropriate for a up to about 9 servers, which is a valid use case for some rare needs. Consider a single server that never needs to scale, has no ELB, etc, and your IP address range has to integrate with a large corporate range without NAT. – Tim Jan 7 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.