10.0.0.0/8 — the big private block
10.0.0.0/8 is the largest of the three private IPv4 ranges defined by RFC 1918: 16,777,216 addresses, from 10.0.0.0 to 10.255.255.255. Anyone may use these addresses inside their own network, with one hard rule — they must never be routed on the public Internet. ISPs drop 10.x packets at their borders, which is exactly what makes the range safe for everyone to reuse simultaneously.
Because of its sheer size, 10/8 is the default choice for anything that needs room to grow: corporate networks, cloud VPCs (AWS, Azure and GCP all default to 10.x space), Kubernetes pod networks, and container platforms.
| Network address | 10.0.0.0 |
| Subnet mask | 255.0.0.0 |
| Wildcard mask | 0.255.255.255 |
| Broadcast address | 10.255.255.255 |
| First usable | 10.0.0.1 |
| Last usable | 10.255.255.254 |
| Total addresses | 16,777,216 |
| Usable hosts | 16,777,214 |
Why private addressing exists
IPv4 has about 4.3 billion addresses and they ran out — IANA handed out the last /8s in 2011. RFC 1918 (1996) was the pressure valve: instead of every device needing a scarce public address, entire networks share one via NAT. Your laptop's 10.x address works because your router rewrites it to a public address on the way out, and rewrites replies back on the way in.
An important nuance: private doesn't mean unroutable. You can route 10/8 all day long inside your own organization — between offices, across VPNs, between VPC peering connections. What's impossible is routing it *between* organizations over the public Internet, because a million networks all use the same addresses.
The three RFC 1918 ranges compared
10.0.0.0/8 holds 16.7 million addresses and suits networks that subnet aggressively. 172.16.0.0/12 holds about 1 million and is the middle child — common in Docker defaults and enterprises avoiding 10.x collisions. 192.168.0.0/16 holds 65,536 and is the home-router range. All three follow the same rule: free to use internally, filtered publicly.
Choosing between them is mostly about collision avoidance. If your company might ever merge with another company or peer with a partner's network, picking a less common slice (say 10.137.0.0/16 instead of 10.0.0.0/16) saves a renumbering project later.
The VPN collision problem
The most common 10/8 headache: you VPN into a network that uses 10.0.0.0/8 while your local network also uses 10.0.0.0/8. The routes overlap and traffic goes to the wrong side. It's the same story when two companies with 10.x networks merge or interconnect. There is no clean fix after the fact — only NAT gymnastics or renumbering — which is why network planners pick oddball subnets inside 10/8 instead of the obvious 10.0.0.0/16.
CIDR Calculator
Run the math on 10.0.0.0/8 — or any other block
Frequently asked questions
Is 10.0.0.0/8 a public or private range?
Private. It's one of three RFC 1918 ranges reserved for internal networks. Routers on the public Internet drop traffic to and from 10.x addresses, so the same range can be reused by unlimited networks at once.
How many addresses are in 10.0.0.0/8?
16,777,216 (2^24). With 24 host bits, it's the largest private block — room for 65,536 subnets of /24 size.
Can I route 10.0.0.0/8 between my office and my VPC?
Yes — RFC 1918 space routes fine across private links you control: VPN tunnels, VPC peering, Direct Connect, leased lines. The restriction only applies to the public Internet.
Why does my company use 10.x but my home uses 192.168.x?
Scale and habit. Home routers default to 192.168.0.0/16 because a /24 out of it is plenty for a household. Companies and clouds need far more addresses and subnets, so they take 10.0.0.0/8.