Splitting a block into equal subnets is easy, and it wastes space as soon as the networks differ in size. VLSM (variable-length subnet masking) gives each network a prefix sized to fit. The method has five mechanical steps, and the order you place the subnets in decides whether the plan is clean or fragmented. This guide works through one example from start to finish.
/26 holds and where it may start. If not, read CIDR Notation and Subnetting Explained first.The Example
A small office has been given 192.168.10.0/24 — 256 addresses — and needs four networks:
| Network | Hosts needed |
|---|---|
| Office LAN | 100 |
| Wi-Fi guests | 50 |
| Servers | 25 |
| Router link | 2 |
Equal splitting fails straight away: the office needs at least a /25 (126 hosts), and four /25s would take 512 addresses. VLSM fits all four into the /24 with space to spare.
Step 1 — List Every Network and Its Real Host Count
For each network, count every address that needs to be assigned, not just the devices people think of:
- Clients, servers, printers, cameras, access points and switches with management IPs.
- The default gateway — and two or three more if you run VRRP or HSRP.
- Addresses your platform reserves (five per subnet in AWS and Azure).
- Growth. Renumbering a live subnet is far more work than one extra bit now.
Step 2 — Round Each Count Up to a Prefix
Each subnet has to be a power of two in size, minus two addresses for the network and broadcast. Find the smallest block whose usable count covers the need:
| Network | Needs | Prefix | Block size | Usable |
|---|---|---|---|---|
| Office LAN | 100 | /25 | 128 | 126 |
| Wi-Fi guests | 50 | /26 | 64 | 62 |
| Servers | 25 | /27 | 32 | 30 |
| Router link | 2 | /30 | 4 | 2 |
Add up the block sizes: 128 + 64 + 32 + 4 = 228. That is under 256, so the plan fits. If the total had come to more than the block holds, no arrangement would work and you would need a bigger block or smaller subnets.
hosts needed → smallest prefix
2 → /30 (2 usable) a /31 also works on point-to-point links
3–6 → /29
7–14 → /28
15–30 → /27
31–62 → /26
63–126 → /25
127–254 → /24Step 3 — Sort Largest First
This is the step that makes VLSM work. A block can only start on a multiple of its own size, so a /25 must start at .0 or .128. Place the big blocks first and each one ends exactly on a boundary the next, smaller block can start on.
Here is what happens if you place them in another order, say Servers, Wi-Fi, Office, Router:
Mixed order (wrong)
.0 – .31 Servers /27
.32 – .63 (gap: a /26 can't start until .64)
.64 – .127 Wi-Fi /26
.128 – .255 Office /25
Router link /30 → nothing left after .255
The space exists (.32–.63 is free), but only if you go back and hunt for it.Largest first never leaves those gaps, because each block size divides every size placed before it. Laid out one after another, the subnets always fit when their sizes add up to no more than the parent block, and the free space is in one place at the end.
Step 4 — Allocate in Order from the Start of the Block
Start at the network address and lay each subnet down in sorted order. Each one begins where the previous one ended:
| Network | Subnet | Gateway / first host | Last host | Broadcast |
|---|---|---|---|---|
| Office LAN | 192.168.10.0/25 | .1 | .126 | .127 |
| Wi-Fi guests | 192.168.10.128/26 | .129 | .190 | .191 |
| Servers | 192.168.10.192/27 | .193 | .222 | .223 |
| Router link | 192.168.10.224/30 | .225 | .226 | .227 |
Check each start against its block size: 0 is a multiple of 128, 128 of 64, 192 of 32 and 224 of 4. If any start fails that test, something is out of order.
Step 5 — Record the Free Space as Aligned Blocks
The plan uses .0 to .227, leaving .228 to .255. Write the remainder down as the largest aligned blocks it splits into, not as a raw range:
Free
192.168.10.228/30 4 addresses
192.168.10.232/29 8 addresses
192.168.10.240/28 16 addressesNow a future request is simple: a 10-host network takes the /28, another router link takes the /30. Keeping free space listed this way stops the next person from carving a subnet out of the middle of an existing one.
Step 6 — Verify: No Overlaps, Correct Edges
Before anything goes into a router, check the plan two ways:
- No two subnets overlap. Each subnet's range should end before the next begins. Overlaps are the classic VLSM mistake and cause traffic to route to the wrong interface.
- Edge addresses land where you expect. Use the calculator's Check an address tab on the boundary addresses —
.127should be the office broadcast,.128the Wi-Fi network address.
# A quick overlap check with Python's standard library
python3 - <<'EOF'
import ipaddress as ip, itertools
plan = ["192.168.10.0/25", "192.168.10.128/26", "192.168.10.192/27", "192.168.10.224/30"]
nets = [ip.ip_network(n) for n in plan]
for a, b in itertools.combinations(nets, 2):
if a.overlaps(b):
print("OVERLAP:", a, b)
print("checked", len(nets), "subnets")
EOF192.168.10.0/24. List every range you connect to and run the same overlap check across all of them.Step 7 — Document the Plan
Record each subnet with its name, VLAN, gateway, DHCP range and owner, plus the free blocks. A spreadsheet is enough. Two habits keep the plan healthy:
- Leave room next to subnets likely to grow. If the office might double, keeping the neighbouring block of the same size free lets you widen it later by shortening the prefix one bit, without renumbering.
- Allocate from the free list, not from memory. Every new subnet comes out of a listed free block, and the remainder goes back on the list.
Frequently Asked Questions
1. What is VLSM?
Variable-length subnet masking: splitting one address block into subnets of different sizes, each sized to what it needs, instead of equal pieces. A 100-host office gets a /25 and a two-router link gets a /30 from the same /24. It is the normal way to subnet since CIDR; the name dates from when equal-sized subnets were the default.
2. Why allocate the largest subnet first?
Because every block has to start on a multiple of its own size. If you place large blocks first, each one ends on a boundary that the next, smaller block can start on, so there are no gaps. Place a /30 first and the next /25 cannot start until .128, leaving .4–.127 as a gap you have to remember and backfill by hand.
3. How many hosts should I plan for?
Count what is there today, add the gateway and any addresses your platform reserves, then add growth — a common rule is to double the expected device count, or at least plan for the next two years. Renumbering a live subnet means touching DHCP, firewall rules, static hosts and monitoring; an extra prefix bit up front costs nothing.
4. Does VLSM apply to IPv6?
Not in the same way. Every IPv6 segment with hosts is a /64, whatever its size, so there is nothing to size by host count. You plan IPv6 by how many /64s each site or building needs and allocate on 4-bit boundaries (/48, /52, /56, /60). The Subnet Calculator splits an IPv6 block into /64s on its Split tab.
5. What should I do with the leftover space?
Leave it unallocated and write it down as named free blocks — 192.168.10.240/28 and so on — so the next request does not overlap an existing subnet. Keeping the free space as a few large aligned blocks, rather than scattered fragments, is what lets you add a big subnet later.
6. Do cloud subnets follow the same rules?
Yes, with more reserved addresses. AWS and Azure reserve five addresses in every subnet (the first four and the last), so a /28 gives 11 usable instead of 14, and AWS will not create a subnet smaller than /28. Add those reservations to each host count before sizing. VPC peering and VPNs also require that the address ranges do not overlap, so plan cloud ranges alongside your on-premise ones.