How to Create Public and Private Subnets in AWS VPC

By Ravindra Bagale, trainer · LinkedIn · Last updated: 18 October 2026

1. Why the VPC needs subnets

Why: the three tiers need separate places in the VPC: the web servers must be reachable from the internet, the app and database servers must not. A subnet is a block of the VPC's range, and each subnet gets its own rules.

The plan for this chapter: VPC 10.0.0.0/16 (65,536 IPs, 10.0.0.0 to 10.0.255.255), split into /20 subnets of 4,096 IPs each. How /16 and /20 are counted is in Worked example: 10.0.0.0/20 and its last IP.

2. Subnet 1: 10.0.0.0/20

1. /20 means the first 20 bits stay fixed in every IP of the subnet: two full octets and the first 4 bits of the 3rd octet.
2. The 3rd octet is 0 = 0000 0000. Set its 4 free bits to 1: 0000 1111 = 15.
3. Subnet 1 = 10.0.0.0 to 10.0.15.255, 4,096 IPs.

3. Subnet 2: start at the last IP + 1

Rule: the next subnet starts right after the last IP of the previous one.

1. Last IP of subnet 1: 10.0.15.255. Add 1: the 4th octet rolls over to 0 and the 3rd goes up by 1, so 10.0.16.0.
2. Subnet 2 = 10.0.16.0/20. Now find its last IP.
3. Write the binary places by doubling eight times from 1: 1, 2, 4, 8, 16, 32, 64, 128. From the left: 128 64 32 16 8 4 2 1.
4. Pick the places that add up to 16: only 16. So 16 = 0001 0000.
5. Keep the first 4 bits 0001, set the last 4 to 1: 0001 1111 = 16 + 8 + 4 + 2 + 1 = 31.
6. Subnet 2 = 10.0.16.0 to 10.0.31.255.

4. Subnet 3 and the shortcut

1. Last IP of subnet 2 + 1: 10.0.31.255 + 1 = 10.0.32.0.
2. 32 = 0010 0000. Keep 0010, set the rest to 1: 0010 1111 = 32 + 8 + 4 + 2 + 1 = 47.
3. Subnet 3 = 10.0.32.0 to 10.0.47.255.

The shortcut: a /20 has 4 free bits in the 3rd octet, so each block covers 16 values of it. The blocks start at 0, 16, 32, 48, 64, and so on, and each ends 15 later.

5. Overlapping subnets are refused

What: two subnets of one VPC can't share any IP. If you try to create 10.0.14.0/24 while 10.0.0.0/20 exists, AWS refuses it with a message that the CIDR conflicts with another subnet: 10.0.14.0 to 10.0.14.255 lies inside 10.0.0.0 to 10.0.15.255.

How to avoid it:

1. Carve the subnets in order, each starting at the last IP + 1 of the one before.
2. Don't leave gaps. A gap of odd-sized space between blocks is hard to use later, and those IPs are wasted.
3. Keep a small table like the one above for every VPC you design.

6. One subnet lives in one Availability Zone

What:

1. The VPC covers the whole Region, but each subnet is in exactly one AZ. You choose the AZ when you create the subnet.
2. A common layout: 10.0.0.0/20 in ap-south-1a, 10.0.16.0/20 in ap-south-1b, 10.0.32.0/20 in ap-south-1c.
3. A server is launched into a subnet, so the subnet decides its AZ. To spread servers over AZs, create subnets in each AZ.
4. Each tier can have its own subnets: web subnets, app subnets and database subnets.

7. The default VPC and its subnets

What AWS made for you: every Region of your account has a default VPC 172.31.0.0/16, with one default /20 subnet in each AZ: 172.31.0.0/20, 172.31.16.0/20, 172.31.32.0/20, and so on.

1. When you launch an instance and don't choose a subnet, AWS puts it in one of the default subnets.
2. To control where it goes, open Network settings > Edit in the launch wizard and pick the VPC and the Subnet.

Why it exists: so that you can launch a server in the first minute, without designing a network. AWS builds the same network in every Region that is turned on in your account.

What is inside a default VPC:

1. CIDR 172.31.0.0/16 in every Region.
2. One default subnet per Availability Zone, each a /20. A Region with 6 AZs, like us-east-1, has 6 default subnets.
3. One internet gateway, already attached.
4. A main route table with 0.0.0.0/0 to that internet gateway, so all default subnets are public.
5. A main network ACL that allows everything, and a DHCP option set that hands each server its private IP.
6. Regions launched after March 2019 (for example Cape Town or Hyderabad) are opt-in: they stay disabled, with nothing in them, until you enable them for your account.

Worked example: the default /20 subnets in us-east-1

1. A /20 holds 2^(32−20) = 2^12 = 4,096 IPs, which is 16 values of the 3rd octet.
2. Subnet 1: 172.31.0.0/20 (172.31.0.0 to 172.31.15.255).
3. Subnet 2: 172.31.16.0/20.
4. Subnet 3: 172.31.32.0/20.
5. Subnet 4: 172.31.48.0/20.
6. Subnet 5: 172.31.64.0/20.
7. Subnet 6: 172.31.80.0/20 (ends at 172.31.95.255).
8. Next free block for your own subnet: 172.31.96.0/20, then 172.31.112.0/20.
9. Usable IPs in each: 4,096 − 5 = 4,091.

Tenancy: who else is on the same hardware

An Availability Zone is one or more data centers. A data center has racks, and a rack has physical servers (hosts). Your EC2 instance runs on one host.

1. Default (shared) tenancy: your instance may run on a host that also runs other customers' instances. Each instance is isolated, and this is the cheapest option. Most workloads use it.
2. Dedicated instance: your instances run on hardware used only by your account. Use it when a rule (compliance) says no sharing.
3. Dedicated Host: one whole physical server is given to you, and you see and control it. Use it for software licences counted per physical server.
4. Dedicated options cost more, so pick Default unless a rule asks otherwise.

8. Where a server's private IP comes from

1. The private IP always comes from the range of the server's subnet. A server in 10.0.16.0/20 gets an IP between 10.0.16.4 and 10.0.31.254.
2. You don't type it. The VPC's DHCP service offers the instance one free address from the subnet, and the instance uses it. You can also choose a specific free IP from the range when you launch.
3. Who hands out addresses at home is in Who hands out IP addresses.

9. Private and public IPs

Private IP ranges (RFC 1918): these three ranges are kept for private networks and are never used on the internet. Use them for VPCs.

Public IPs are owned by internet providers and clouds. In AWS a server gets one from the EC2 public IP pool (auto-assigned) or as an Elastic IP (What an Elastic IP is). AWS charges for every public IPv4 address by the hour, so only the servers that must be reached from the internet get one.

10. The 5 IPs AWS keeps in every subnet

Example: subnet 10.0.32.0/20 (10.0.32.0 to 10.0.47.255):

1. 10.0.32.0: the network address.
2. 10.0.32.1: the VPC router.
3. 10.0.32.2: the Amazon DNS server.
4. 10.0.32.3: kept by AWS for future use.
5. 10.0.47.255: the last IP. AWS keeps it because a VPC doesn't support broadcast.

So the first server can get 10.0.32.4, and the last usable IP is 10.0.47.254.

11. Usable IPs and how many subnets fit

Usable IPs = total − 5:

/16 is the largest and /28 the smallest block AWS allows, for a VPC and for a subnet. A VPC that needs more can get extra CIDR blocks later.

How many subnets fit in a /16 VPC: divide the sizes, or use 2 to the power (subnet prefix − 16).

1. /20: 65,536 ÷ 4,096 = 16 (2 to the power 4).
2. /22: 65,536 ÷ 1,024 = 64 (2 to the power 6).
3. /24: 65,536 ÷ 256 = 256 (2 to the power 8).

An architect's design for Mumbai:

1. VPC 172.31.0.0/16 in ap-south-1.
2. 172.31.0.0/20 in ap-south-1a, 172.31.16.0/20 in ap-south-1b, 172.31.32.0/20 in ap-south-1c.
3. 4,091 usable IPs in each, and 13 more /20 blocks free for later.

12. Internet gateway: public and private subnets

Why: a new VPC has no way to the internet at all. In a 3-tier app only the web tier gets public IPs; the app and database tiers stay private.

What:

1. An internet gateway (IGW) connects a VPC to the internet. A VPC can have one internet gateway attached.
2. A subnet is public if its route table sends 0.0.0.0/0 to the internet gateway. Otherwise it is private.
3. So "public" and "private" are not settings of the subnet itself: the route table decides.

13. Route tables: Destination and Target

What: a route table is a list of routes. Each route has two columns:

1. Destination: the IP range the traffic is going to, as a CIDR.
2. Target: where to send that traffic.

The public route table:

The private route table:

1. The local route is in every route table and can't be removed: all subnets of the VPC can talk to each other.
2. When several routes match, the most specific one wins: traffic to 10.0.16.7 matches both rows of the public table, and 10.0.0.0/16 (a /16 is more specific than /0) sends it locally.
3. Traffic for the internet matches only 0.0.0.0/0. In the private table nothing matches, so it isn't sent.

14. The main route table

What: every VPC has a main route table. Any subnet that you have not explicitly associated with another route table uses the main one automatically.

1. Default VPC: its main route table has 0.0.0.0/0 to the internet gateway, so every default subnet is public.
2. A new custom VPC: its main route table has only the local route, so every new subnet starts private.
3. Good practice: keep the main route table private. Create a separate public route table and associate only the web subnets with it. Then a subnet that someone forgets to associate stays private, not public.

15. Build it in the console

Part A: subnets (in the VPC 10.0.0.0/16 from the previous chapter)

1. VPC > Subnets > Create subnet. Pick the VPC ID of my-vpc.
2. Subnet name web-a, Availability Zone ap-south-1a, IPv4 subnet CIDR block 10.0.0.0/20.
3. Add new subnet: app-b, ap-south-1b, 10.0.16.0/20.
4. Add new subnet: db-c, ap-south-1c, 10.0.32.0/20.
5. Create subnet. Each shows Available IPv4 addresses 4091.

Part B: internet gateway

1. Internet gateways > Create internet gateway, name my-igw, Create.
2. Actions > Attach to VPC, pick my-vpc, Attach internet gateway.

Part C: public route table

1. Route tables > Create route table, name public-rt, VPC my-vpc, Create.
2. Routes > Edit routes > Add route: Destination 0.0.0.0/0, Target Internet Gateway my-igw. Save changes.
3. Subnet associations > Edit subnet associations: tick web-a only. Save associations.
4. Select web-a, Actions > Edit subnet settings, tick Enable auto-assign public IPv4 address, Save, so servers launched there get a public IP.

app-b and db-c stay on the main route table: private.

Part D: lab in the default VPC: a public IP is not enough

Why: many people think a server with a public IP is reachable from the internet. This lab shows that the route table decides.

1. VPC > Subnets > Create subnet in the default VPC: DefaultVpcPublicSubnet, us-east-1a, 172.31.96.0/20.
2. Add new subnet: DefaultVpcPvtSubnet, us-east-1b, 172.31.112.0/20. Create subnet.
3. Both new subnets attach to the main route table automatically, and in the default VPC that table is public.
4. Route tables > Create route table: CustomPvtRouteTable in the default VPC. It has only the local route.
5. Subnet associations: associate DefaultVpcPvtSubnet with CustomPvtRouteTable. DefaultVpcPublicSubnet stays on the main route table.
6. Launch a t2.micro Amazon Linux 2023 instance public ec2 in DefaultVpcPublicSubnet with Auto-assign public IP enabled and a security group that allows SSH (22) and HTTP (80).
7. Connect: ssh -i key.pem ec2-user@<public-ip>.
8. Install and start Nginx:

sudo yum install nginx -y sudo service nginx start

1. Put a page in /usr/share/nginx/html/ and open http://<public-ip>/ in the browser: it loads.
2. Launch a second instance pvt ec2 in DefaultVpcPvtSubnet, and on purpose enable Auto-assign public IP here too, with the same security group.
3. Try ssh -i key.pem ec2-user@<its-public-ip>: it times out. The server has a public IP, but its subnet's route table has no route to the internet gateway, so replies never leave the VPC.
4. Add a route to CustomPvtRouteTable: Destination 0.0.0.0/0, Target the default VPC's internet gateway. SSH now works, and after installing Nginx the page loads.
5. Remove that route again: the page stops loading.

Result: a public IP gives a server an address on the internet. The route 0.0.0.0/0 → igw gives it a way out. It needs both.

16. When something goes wrong

1. "conflicts with another subnet": the new CIDR overlaps an existing subnet. Take the next free block from your table.
2. The CIDR is refused as outside the VPC: the subnet must lie inside the VPC's range, for example 10.0.x.x in 10.0.0.0/16.
3. A server in the "public" subnet can't be reached: check that it has a public IP, that the subnet's route table has 0.0.0.0/0 to the IGW, that the IGW is attached, and that the security group allows the port.
4. A subnet you meant to be private is public: it is associated with the public route table, or the main route table has an IGW route. Fix the association.
5. You can't create more servers in a subnet: it ran out of usable IPs; remember the 5 that AWS keeps.

17. The whole class on one page

1. A subnet is a block of the VPC's range; /20 subnets of 10.0.0.0/16 start at 0, 16, 32 ... in the 3rd octet.
2. Next subnet = last IP + 1. Binary: 16 = 0001 0000 → 0001 1111 = 31; 32 = 0010 0000 → 0010 1111 = 47.
3. Overlapping subnets are refused ("conflicts with another subnet"); carve in order with no gaps.
4. Each subnet is in exactly one AZ; the default VPC 172.31.0.0/16 has a default /20 in each AZ.
5. A server's private IP comes from its subnet, handed out by DHCP. Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Public IPv4 addresses are charged.
6. AWS keeps 5 IPs per subnet: network, VPC router, DNS, future use, last. Usable = total − 5: /20 4,091, /24 251, /28 11.
7. A /16 holds 16 × /20, 64 × /22, 256 × /24.
8. One internet gateway per VPC. Public subnet = route table with 0.0.0.0/0 → IGW; private = no such route.
9. Route table columns: Destination (CIDR), Target (local, igw-...).
10. Subnets without an explicit association use the main route table; keep it private in a custom VPC.

18. Try at home

Recap

Quick revision cards

Revise this chapter in two minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens its lesson.

More cards: Ravi Sir's Cards: AWS VPC and Subnets.