/28 subnet: mask 255.255.255.240, 14 usable hosts

What /28 means

Four host bits remain, so the mask is 255.255.255.240 and the wildcard 0.0.0.15. Networks start at multiples of 16 in the last octet.

2^4 = 16 addresses, 14 after network and broadcast. 10.0.0.0/28 has usable hosts 10.0.0.1 to 10.0.0.14 and broadcast 10.0.0.15.

The cloud minimum

AWS accepts VPC and subnet blocks from /16 down to /28, so /28 is the floor. AWS reserves five addresses in each subnet: the network address, the VPC router at .1, the DNS resolver at .2, .3 held for future use, and the broadcast. That leaves 11 assignable addresses in a /28.

Azure also reserves five per subnet but allows subnets down to /29. AWS suggests a small dedicated subnet, a /28 is enough, for Transit Gateway attachments; EKS or Lambda subnets need far larger blocks.

Uses and splitting

Use /28 for transit or attachment subnets, a pair of NAT instances, or a small block of public IPs from an ISP. A /28 splits into two /29s, and two aligned /28s make a /27. Sixteen /28s fill a /24.

Configuring and pitfalls

Outside the cloud, 10.0.0.0/28 gives hosts 10.0.0.1 through 10.0.0.14 with the usual network and broadcast exclusions. Inside an AWS VPC the first three host addresses belong to AWS, so your own instances start at .4 and the last assignable address is .14.

Running out of addresses is the common failure: a subnet that holds two instances today cannot absorb a rolling deployment that briefly doubles them, or a managed service that adds interfaces. AWS cannot resize a subnet in place, so a too-small subnet means creating a new one and migrating.

Use /28 where the address count is fixed by design, such as an attachment or firewall subnet, and pick something larger wherever compute will scale. Changing a subnet later costs far more than a few idle addresses now.