The /28 prefix: 16 addresses, 14 to actually use
A /28 leaves just 4 host bits: 16 addresses behind the mask 255.255.255.240. Boundaries land on multiples of 16 in the last octet — .0, .16, .32 — sixteen /28s to a /24.
This is the floor for a lot of managed infrastructure: AWS will not let you build a VPC smaller than /28, and it is the size hosting providers hand out when you order a small block of static IPs. Fourteen usable addresses sounds meager until you count how few devices most single-purpose segments really hold.
| Prefix length | /28 |
| Subnet mask | 255.255.255.240 |
| Wildcard mask | 0.0.0.15 |
| Total addresses | 16 |
| Usable hosts | 14 |
The cloud minimum
AWS caps VPC CIDRs at /28 on the small end, and subnets follow the same limit. There is a second bite in the cloud: AWS reserves five addresses per subnet — network, broadcast, plus three for internal services — so a /28 subnet yields eleven addresses you can actually assign. Azure takes a similar five. Budget for it or your capacity plan lies to you.
Small static-IP blocks from your ISP
Order a block of 16 from a business ISP and you will typically receive a routed /28: fourteen assignable addresses once network and broadcast are accounted for, or thirteen if the provider's gateway eats one. It is the right size for a firewall's outside address plus a handful of NAT pools or hosted services, and it is priced accordingly.
CIDR Calculator
Run the math on 10.0.0.0/28 — or any other block
Frequently asked questions
How many IP addresses are in a /28?
16 in total (2^4), with 14 usable for hosts.
What is the subnet mask of a /28?
255.255.255.240. Four network bits in the last octet, so /28 networks begin on multiples of 16: .0, .16, .32 and onward.
Why does AWS give me fewer usable addresses than the math says?
AWS reserves five addresses in every subnet — network, broadcast, and three for internal services — so a /28 VPC subnet has eleven assignable addresses, not fourteen.
What is a /28 good for?
Single-purpose segments: a small DMZ, a WAN transit block, an ISP static-IP allocation, or the smallest VPC the cloud will let you build.