# Planning Address Space — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-cidr-planning

> Choose VPC CIDR blocks that leave room to grow and never overlap with networks you may need to connect.

## Overlap is the mistake you cannot undo cheaply

Choosing a VPC range feels trivial until the day you need to connect two networks. Peering, transit gateways and VPNs all rely on routing, and routing cannot decide where `10.0.5.10` lives if both sides use `10.0.0.0/16`. In AWS you cannot change a VPC's primary CIDR after creation, so fixing an overlap usually means rebuilding. Good practice is to keep a simple **IP address plan**: a table listing every VPC, every on-premises network and every partner network with its range. Give each environment and region its own non-overlapping block, for example `10.10.0.0/16` for production Mumbai and `10.20.0.0/16` for staging. Size generously: AWS VPCs can be from `/16` (65,536 addresses) down to `/28` (16 addresses), and containers or serverless functions can consume IPs far faster than you expect. Larger organisations use an IP address management (IPAM) tool to hand out blocks automatically.

## Catch overlaps before they ship

A tiny script over your address plan finds clashes. Here the office LAN sits inside the production range, so a VPN between them would be ambiguous.

```python
import ipaddress

plan = {
    "prod-mumbai": "10.10.0.0/16",
    "prod-hyderabad": "10.11.0.0/16",
    "staging": "10.20.0.0/16",
    "office-lan": "10.10.128.0/20",
}
nets = {name: ipaddress.ip_network(c) for name, c in plan.items()}
names = list(nets)
for i, a in enumerate(names):
    for b in names[i + 1:]:
        if nets[a].overlaps(nets[b]):
            print(f"CLASH: {a} {nets[a]} overlaps {b} {nets[b]}")
print("checked", len(names), "ranges")
```

Output:

```
CLASH: prod-mumbai 10.10.0.0/16 overlaps office-lan 10.10.128.0/20
checked 4 ranges
```

## From plan to VPC

Address planning flows in three steps: an organisation-wide address plan, a block allocated to one environment and region, and the VPC created with exactly that block.

![Three connected stages from left to right: address plan, allocated block, VPC.](assets/figures/cloud-networking/section-2-map.svg) — Figure 2.1: address plan -> allocated block -> VPC

## Avoid the most popular ranges

`10.0.0.0/16` and `192.168.0.0/16` are what every tutorial and home router uses. Picking a less common block such as `10.42.0.0/16` reduces the chance of clashing with a partner, a VPN user's home network or an acquired company.

**Quiz:** Why is reusing 10.0.0.0/16 for every VPC a problem?

- [ ] AWS charges more for duplicate ranges
- [ ] Instances cannot get DNS names
- [ ] Security groups stop working
- [x] Networks with overlapping ranges cannot be routed to each other

*Answer:* Networks with overlapping ranges cannot be routed to each other. Routing needs each destination range to be unique. Overlapping VPCs cannot be peered or joined through a transit gateway without workarounds.