Planning Address Space

Overlap is the mistake you cannot undo cheaply

Choosing a VPC range feels trivial until the day you need to connect two networks. Peering, transit gateways and VPNs all rely on routing, and routing cannot decide where 10.0.5.10 lives if both sides use 10.0.0.0/16. In AWS you cannot change a VPC's primary CIDR after creation, so fixing an overlap usually means rebuilding. Good practice is to keep a simple IP address plan: a table listing every VPC, every on-premises network and every partner network with its range. Give each environment and region its own non-overlapping block, for example 10.10.0.0/16 for production Mumbai and 10.20.0.0/16 for staging. Size generously: AWS VPCs can be from /16 (65,536 addresses) down to /28 (16 addresses), and containers or serverless functions can consume IPs far faster than you expect. Larger organisations use an IP address management (IPAM) tool to hand out blocks automatically.

Catch overlaps before they ship

A tiny script over your address plan finds clashes. Here the office LAN sits inside the production range, so a VPN between them would be ambiguous.

import ipaddress

plan = {
    "prod-mumbai": "10.10.0.0/16",
    "prod-hyderabad": "10.11.0.0/16",
    "staging": "10.20.0.0/16",
    "office-lan": "10.10.128.0/20",
}
nets = {name: ipaddress.ip_network(c) for name, c in plan.items()}
names = list(nets)
for i, a in enumerate(names):
    for b in names[i + 1:]:
        if nets[a].overlaps(nets[b]):
            print(f"CLASH: {a} {nets[a]} overlaps {b} {nets[b]}")
print("checked", len(names), "ranges")

Output:

CLASH: prod-mumbai 10.10.0.0/16 overlaps office-lan 10.10.128.0/20
checked 4 ranges

From plan to VPC

Address planning flows in three steps: an organisation-wide address plan, a block allocated to one environment and region, and the VPC created with exactly that block.

Avoid the most popular ranges

10.0.0.0/16 and 192.168.0.0/16 are what every tutorial and home router uses. Picking a less common block such as 10.42.0.0/16 reduces the chance of clashing with a partner, a VPN user's home network or an acquired company.

Quick check: Why is reusing 10.0.0.0/16 for every VPC a problem?

• AWS charges more for duplicate ranges
• Instances cannot get DNS names
• Security groups stop working
• Networks with overlapping ranges cannot be routed to each other