IP Addressing in AWS: IPv4, IPv6, Public, Private, and CIDR

When a packet needs to reach a server, it needs an address that identifies the destination and helps the network deliver the packet. An IP address provides that logical addressing.

This is Part 21 of the AWS Cloud Practitioner Study Notes series. The important AWS questions are usually about the difference between public and private IP addresses, how CIDR defines a VPC or subnet range, and which addresses AWS reserves.

What is an IP address?

An IP (Internet Protocol) address is assigned to a network interface so that resources can communicate across an IP network. A useful analogy is a postal address:

• A home address tells the postal service where to deliver a letter.
• An IP address helps the network deliver packets to a destination interface.

For example, an EC2 instance might have a private address such as 10.0.2.10. A laptop on the Internet cannot normally route directly to that private address, so a public-facing design may also use a public IPv4 address, load balancer, or another controlled entry point.

An IP address identifies a network location or interface. It is not necessarily a permanent identity for a physical device, and one resource can have multiple addresses or interfaces.

Minimum and maximum IP addresses

IPv4

An IPv4 address contains four decimal octets separated by dots. Each octet is 8 bits and can range from 0 to 255.

Therefore:

• Minimum IPv4 address: 0.0.0.0
• Maximum IPv4 address: 255.255.255.255
• Total IPv4 address space: 2^32, or 4,294,967,296 addresses

Examples include:

• 8.8.8.8
• 1.1.1.1
• 10.0.0.15
• 172.31.5.20
• 192.168.1.100

The minimum and maximum values describe the mathematical IPv4 address space. They do not mean every address is assignable to an EC2 instance. Some ranges have special purposes, such as private, loopback, link-local, multicast, or documentation use.

IPv6

An IPv6 address contains 128 bits, written as eight hexadecimal groups. Leading zeroes can be omitted, and consecutive all-zero groups can be compressed with ::.

For example:

2001:0db8:85a3:0000:0000:8a2e:0370:7334
2001:db8:85a3::8a2e:370:7334

Both forms represent the same address. IPv6’s mathematical range is:

• Minimum IPv6 address: ::
• Maximum IPv6 address: ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
• Total IPv6 address space: 2^128, approximately 3.4 × 10^38 addresses

AWS VPCs can use IPv4-only, dual-stack, or IPv6-only subnet designs, depending on the resources and connectivity requirements.

IPv4 versus IPv6

Characteristic	IPv4	IPv6
Address size	32 bits	128 bits
Written as	Four decimal octets	Eight hexadecimal groups
Example	10.0.1.15	2001:db8::1
Address capacity	About 4.3 billion	About 3.4 × 10^38
AWS usage	Common for VPCs and legacy systems	Supported for modern VPC designs

IPv6 was introduced largely because the IPv4 address space is limited. Supporting IPv6 does not automatically remove the need to configure routes, security-group rules, network ACLs, and application listeners for IPv6 traffic.

Public and private IP addresses

Public IP address

A public IP address is reachable from the Internet when the rest of the network path and security controls allow the traffic. Public addresses are used for public websites, APIs, and other Internet-facing endpoints.

In EC2, a public IPv4 address can be assigned at launch when the subnet and launch settings allow it. A public address alone does not make an instance reachable: the subnet needs a suitable route, the VPC needs an Internet Gateway path, and security groups, network ACLs, and the operating system must allow the traffic.

Private IP address

A private IP address is used within a private network, such as a VPC. EC2 instances receive a primary private IPv4 address from the subnet’s IPv4 range. Private addresses are used for communication between resources inside the VPC and connected private networks.

A common architecture is:

Resource	Addressing
Public web tier	Private IP plus a public entry point when required
Private application tier	Private IP only
RDS database	Private connectivity inside the VPC

Private IP addressing reduces direct Internet exposure, but it is not a complete security control. Use route tables, security groups, network ACLs, IAM, encryption, and application authentication as appropriate.

Private IPv4 ranges

RFC 1918 reserves these IPv4 ranges for private networks:

Range	CIDR notation	Number of addresses
10.0.0.0 – 10.255.255.255	10.0.0.0/8	16,777,216
172.16.0.0 – 172.31.255.255	172.16.0.0/12	1,048,576
192.168.0.0 – 192.168.255.255	192.168.0.0/16	65,536

These addresses can be reused in separate private networks. They are not globally unique and are not directly advertised across the public Internet.

Static, dynamic, and Elastic IP addresses

Dynamic IP address

A dynamic address is assigned automatically and may change. For example, a home router can assign private addresses with DHCP.

An automatically assigned EC2 public IPv4 address is not permanent. When an EBS-backed EC2 instance is stopped and started, its private IPv4 address persists, but its automatically assigned public IPv4 address normally changes.

Elastic IP address

An Elastic IP address is a persistent public IPv4 address allocated to your AWS account. You can associate it with an EC2 instance or network interface and remap it when your design requires a stable public address.

Use an Elastic IP carefully. For many production web applications, a load balancer or DNS-based design is preferable to exposing a single instance address. AWS also charges for public IPv4 addresses, including Elastic IP addresses, so allocate them only when the architecture needs one.

CIDR notation

CIDR (Classless Inter-Domain Routing) notation represents an IP network and its size:

192.168.1.0/24

The /24 is the prefix length. It means that 24 bits identify the network, leaving 8 bits for addresses inside that network.

For IPv4:

Number of addresses = 2^(32 - prefix length)

CIDR	Total IPv4 addresses	Typical range example
/32	1	One host address
/30	4	192.168.1.0 – 192.168.1.3
/28	16	Small AWS subnet size
/24	256	10.0.1.0 – 10.0.1.255
/16	65,536	Common VPC size
/8	16,777,216	Large private range

As the prefix number becomes larger, the network becomes smaller. A /24 contains more addresses than a /28; a /32 identifies exactly one address.

Minimum and maximum address in a CIDR block

For a normal IPv4 CIDR block, the first address is the network address and the last address is the end of the block.

Example: 192.168.1.0/24

• Minimum address in the block: 192.168.1.0
• Maximum address in the block: 192.168.1.255
• Total addresses: 256

In a traditional subnetting explanation, the first address identifies the network and the last is the broadcast address. AWS VPCs do not support broadcast, but AWS still reserves the first four and last address in each subnet.

AWS subnet usable addresses

AWS reserves five IPv4 addresses in every subnet CIDR block:

1. The network address
2. The VPC router address
3. The VPC DNS server address
4. An address reserved for future use
5. The final address in the subnet range

For 10.0.1.0/24:

Address	AWS status
10.0.1.0	Reserved network address
10.0.1.1	Reserved VPC router address
10.0.1.2	Reserved DNS server address
10.0.1.3	Reserved for future use
10.0.1.4 – 10.0.1.254	Available for resources
10.0.1.255	Reserved final address

Therefore, a /24 subnet has 256 total IPv4 addresses but 251 addresses available for AWS resources. The AWS usable range is not simply “network address plus one through the last address minus one”; the first four addresses are reserved.

The smallest IPv4 subnet AWS permits is /28, with 16 total addresses and 11 available after the five reservations. The largest permitted IPv4 subnet is /16, with 65,536 total addresses and 65,531 available before any additional address reservations or service limits.

AWS VPC example

Suppose you create:

VPC:            10.0.0.0/16
Public subnet:  10.0.1.0/24
Private subnet: 10.0.2.0/24

Possible resource addressing:

Resource	Private IP	Public addressing
Web server	10.0.1.15	Public IPv4 or load balancer entry point
Application server	10.0.2.20	Private IP only
Database	10.0.2.10	Private IP only

The public web tier can receive Internet traffic only when the route, Internet Gateway, public address, security group, NACL, and application configuration all permit it. The database remains private and is reached through private IP connectivity from the application tier.

Cloud Practitioner exam notes

• IPv4: 32 bits, four decimal octets, each from 0 to 255.
• IPv6: 128 bits, hexadecimal notation, designed to provide a much larger address space.
• Public IP: Internet-reachable when routing and security controls permit it.
• Private IP: Used inside a VPC or other private network.
• Elastic IP: Persistent public IPv4 address allocated to an AWS account.
• CIDR: Defines the network address and the size of the address block.
• VPC example: 10.0.0.0/16.
• Subnet example: 10.0.1.0/24.
• AWS subnet reservation: Five IPv4 addresses per subnet are unavailable for resource assignment.
• EC2 stop/start: Private IPv4 addresses persist; automatically assigned public IPv4 addresses normally change.

Final takeaway

An IP address identifies where a network interface can be reached. IPv4 uses 32 bits, IPv6 uses 128 bits, public addresses provide Internet-facing reachability, and private addresses support internal communication. CIDR expresses the size of a network, while AWS subnet reservations determine how many addresses you can actually assign.

For the exam, calculate both numbers: a 10.0.1.0/24 subnet contains 256 total addresses, but AWS makes only 251 available. The minimum and maximum addresses of that block are 10.0.1.0 and 10.0.1.255, while the first assignable AWS address is 10.0.1.4.

Sources

• IP addressing for your VPCs and subnets — Amazon VPC documentation
• Subnet CIDR blocks — Amazon VPC documentation
• Amazon EC2 instance IP addressing
• How EC2 instance stop and start works
• VPC CIDR blocks
• RFC 1918: Address Allocation for Private Internets