🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🔢 धडा 02 — CIDR आणि IP addresses: campus साठी घरांचे नंबर

📍 तुम्ही इथे आहात: 12 पैकी धडा 02 · मागे: lesson-01-why-vpc · पुढे: lesson-03-subnets-azs

📦 या ब्रँचमध्ये काय आहे

धडा 01, आणि नंबर: 10.20.0.0/16 सारखा CIDR block तुमच्या मालकीचे किती पत्ते आहेत ते कसे सांगतो, कोणत्या ranges private आहेत, आणि परत फिरवता न येणारा आराखड्याचा एक नियम — कधीच overlap नको. vpc/demo.py मधील cidr() आणि vpc/network.py मधील overlaps().

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

Campus वरच्या प्रत्येक खोलीला घराचा नंबर लागतो, म्हणजे पत्रे तिथे पोहोचतात. IPv4 address म्हणजे चार नंबर, जसे 10.20.96.15.

शाळा प्रत्येक नंबर एकेक करून लिहित नाही. ती एक नियम लिहिते: "10.20. ने सुरू होणारे सगळे नंबर". तो नियम म्हणजे CIDR block: 10.20.0.0/16.

/16 चा अर्थ: पहिले 16 bits ठरलेले — बाकीचे तुमचे. कमी bits ठरवले तर जास्त नंबर मिळतात. जास्त bits ठरवले तर कमी:

/16 → 65,536 घरांचे नंबर (पूर्ण campus)
/20 → 4,096 (एक मोठा wing)
/24 → 256 (एक छोटा wing)
/28 → 16 (एक अगदी छोटी खोली)

आणखी एक नियम. दोन campuses नी तेच घरांचे नंबर वापरले, तर 10.0.5.9 साठीच्या पत्राला कोणत्या campus ला जायचे ते कळणार नाही. म्हणून जी range तुम्ही कधीतरी जोडू शकता, ती तुम्ही कधीच पुन्हा वापरत नाही.

🗺️ आकृती

flowchart LR
    ip["10.20.96.15<br/>00001010.00010100.01100000.00001111"]
    p16["/16 → first 16 bits fixed<br/>65,536 addresses"]
    p20["/20 → 4,096"]
    p24["/24 → 256"]
    p28["/28 → 16"]
    ip --> p16 --> p20 --> p24 --> p28
    office["🏢 office 10.0.0.0/16"]
    bad["10.0.128.0/17 → OVERLAPS"]
    good["10.20.0.0/16 → no overlap"]
    office -.-> bad
    office -.-> good

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/vpc/lesson-diagrams.html#l02

❓ काय

IPv4 address — 32 bits, 0 ते 255 मधील चार नंबरांत लिहिलेले.
CIDR notation — address/prefix. Prefix म्हणजे सुरुवातीचे किती bits ठरलेले आहेत. त्या block मध्ये 2^(32 − prefix) पत्ते असतात: /20 → 2^12 = 4,096.
Private ranges (RFC 1918) — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. त्या public internet वर कधीच route होत नाहीत, म्हणून प्रत्येक company त्या आत पुन्हा वापरू शकते. VPC साठी यांपैकीच एक वापरा.
VPC चा आकार — VPC चा IPv4 block /16 आणि /28 च्या दरम्यान असतो. नंतर तुम्ही secondary CIDR blocks जोडू शकता (धडा 12), पण primary block बदलता किंवा लहान करता येत नाही.
Overlap — दोन blocks मध्ये एक जरी पत्ता सारखा असला तरी ते overlap होतात. 10.0.128.0/17 हा 10.0.0.0/16 च्या आत बसतो, म्हणून ते overlap होतात. Overlap होणारी networks peer करता येत नाहीत (धडा 09) आणि Transit Gateway किंवा VPN मधून route करणे त्रासदायक असते.
IPAM — VPC IP Address Manager: company चा IP आराखडा pools म्हणून ठेवणारी आणि नव्या VPCs ना overlap न होणारे blocks वाटणारी AWS service.

🤔 का

कारण range हा असा एकच निर्णय आहे जो नंतर बदलणे जवळजवळ अशक्य असते. Servers नी भरलेल्या VPC ला एका weekend मध्ये पुन्हा numbering करता येत नाही. ज्या दिवशी office VPN, partner किंवा दुसरा Region जोडावा लागतो, त्या दिवशी overlap होणारी range एका तासाच्या कामाचे migration करून टाकते.

🔧 कसे (या repo मध्ये)

vpc/demo.py मधील cidr() चार prefixes साठी 2 ** (32 - p) छापतो, आणि मग overlaps() ने तीन उमेदवार ranges office network 10.0.0.0/16 विरुद्ध तपासतो. vpc/network.py मधील overlaps() ही Python च्या ipaddress.ip_network(...).overlaps(...) वर लिहिलेली एक ओळ आहे.

🧪 करून पाहा

python3 vpc/demo.py cidr
python3 - <<'EOF'
import sys, ipaddress; sys.path.insert(0, "vpc"); from network import overlaps
for c in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "10.20.0.0/16", "8.8.8.0/24"):
    print(c.ljust(15), "private" if ipaddress.ip_network(c).is_private else "PUBLIC")
for p in (17, 22, 26):
    print(f"/{p}", 2 ** (32 - p))
print(overlaps("10.20.0.0/16", "10.21.0.0/16"), overlaps("10.20.0.0/16", "10.20.200.0/24"))
EOF

✅ तपासा — तुम्हाला काय दिसायला हवे

cidr चार आकार छापतो — 65,536, 4,096, 256, 16 — आणि मग:

   10.0.0.0/16    vs the office network 10.0.0.0/16: OVERLAPS — pick another range
   10.0.128.0/17  vs the office network 10.0.0.0/16: OVERLAPS — pick another range
   10.20.0.0/16   vs the office network 10.0.0.0/16: no overlap → safe to connect later

तुमचा snippet तीन RFC 1918 ranges साठी आणि 10.20.0.0/16 साठी private छापतो, 8.8.8.0/24 साठी PUBLIC; मग /17 32768, /22 1024, /26 64; आणि मग False True — 10.21.0.0/16 शेजारी आहे, पण 10.20.200.0/24 campus च्या आत आहे.

🏁 तुम्ही आत्ताच काय सिद्ध केले

तुम्ही कोणताही prefix आकार म्हणून वाचू शकता, private range आणि public range मधला फरक ओळखू शकता, आणि overlap बांधला जाण्यापूर्वीच पकडू शकता.

⚠️ नेहमीच्या चुका

प्रत्येक account मध्ये 10.0.0.0/16 "कारण wizard ने सुचवले" — मग ते सगळे कधीच जोडता येत नाहीत
office network, partner किंवा VPN शी overlap होणारी range निवडणे
खूपच लहान VPC (EKS cluster साठी /24 — pods VPC चे पत्ते घेतात)
तुमच्या मालकीचे नसलेले public पत्ते "private" range म्हणून वापरणे
primary CIDR नंतर बदलता येईल असे समजणे — येत नाही; तुम्ही फक्त आणखी जोडू शकता

🏭 प्रत्यक्ष वापरात

मोठ्या teams पूर्ण company साठी एकच IP आराखडा ठेवतात — प्रत्येक VPC, प्रत्येक Region, office, partners — आणि त्यातूनच ranges वाटतात, सहसा IPAM वापरून.

खऱ्या account वर (AWS CLI आणि credentials लागतात; IDs उदाहरणादाखल आहेत):

aws ec2 create-ipam --operating-regions RegionName=ap-south-1
aws ec2 create-ipam-pool --ipam-scope-id ipam-scope-0123456789abcdef0 \
    --address-family ipv4 --locale ap-south-1
aws ec2 provision-ipam-pool-cidr --ipam-pool-id ipam-pool-0123456789abcdef0 --cidr 10.0.0.0/8
aws ec2 create-vpc --ipv4-ipam-pool-id ipam-pool-0123456789abcdef0 --ipv4-netmask-length 16

⏭️ पुढे

Campus कडे 65,536 घरांचे नंबर आहेत. आता ते wings मध्ये वाटा, प्रत्येक इमारतीसाठी एक — subnets आणि AZs, आणि AWS प्रत्येक wing मध्ये स्वतःकडे ठेवतो ते 5 नंबर.

git checkout lesson-03-subnets-azs

🔢 Lesson 02 — CIDR & IP addresses: house numbers for the campus

📍 You are here: Lesson 02 of 12 · Previous: lesson-01-why-vpc · Next: lesson-03-subnets-azs

📦 What's in this branch

Lesson 01, plus the numbers: how a CIDR block like 10.20.0.0/16 says how many addresses you own, which ranges are private, and the one planning rule you cannot undo — never overlap. cidr() in vpc/demo.py and overlaps() in vpc/network.py.

🧒 Explain like I'm 5

Every room on the campus needs a house number so letters reach it. An IPv4 address is four numbers, like 10.20.96.15.

The school does not list every number one by one. It writes a rule: "all numbers that start with 10.20.". That rule is a CIDR block: 10.20.0.0/16.

The /16 means: the first 16 bits are fixed — the rest are yours. Fix fewer bits and you get more numbers. Fix more bits and you get fewer:

/16 → 65,536 house numbers (a whole campus)
/20 → 4,096 (one big wing)
/24 → 256 (one small wing)
/28 → 16 (one tiny room)

One more rule. If two campuses use the same house numbers, a letter for 10.0.5.9 cannot know which campus to go to. So you never reuse a range you might one day connect.

🗺️ Diagram

flowchart LR
    ip["10.20.96.15<br/>00001010.00010100.01100000.00001111"]
    p16["/16 → first 16 bits fixed<br/>65,536 addresses"]
    p20["/20 → 4,096"]
    p24["/24 → 256"]
    p28["/28 → 16"]
    ip --> p16 --> p20 --> p24 --> p28
    office["🏢 office 10.0.0.0/16"]
    bad["10.0.128.0/17 → OVERLAPS"]
    good["10.20.0.0/16 → no overlap"]
    office -.-> bad
    office -.-> good

🗺️ Drawn version + a lab: https://school-edh.pages.dev/vpc/lesson-diagrams.html#l02

❓ What

IPv4 address — 32 bits, written as four numbers from 0 to 255.
CIDR notation — address/prefix. The prefix is how many leading bits are fixed. The block holds 2^(32 − prefix) addresses: /20 → 2^12 = 4,096.
Private ranges (RFC 1918) — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. They are never routed on the public internet, so every company can reuse them inside. Use one of these for a VPC.
VPC size — a VPC's IPv4 block is between /16 and /28. You can later add secondary CIDR blocks (lesson 12), but you cannot change or shrink the primary one.
Overlap — two blocks overlap if they share even one address. 10.0.128.0/17 sits inside 10.0.0.0/16, so they overlap. Overlapping networks cannot be peered (lesson 09) and are painful to route through a Transit Gateway or VPN.
IPAM — VPC IP Address Manager: an AWS service that holds your company's IP plan as pools and hands out non-overlapping blocks to new VPCs.

🤔 Why

Because the range is the one decision that is almost impossible to change later. A VPC full of servers cannot be renumbered on a weekend. The day the office VPN, a partner or a second Region must connect, an overlapping range turns a one-hour job into a migration.

🔧 How (in this repo)

cidr() in vpc/demo.py prints 2 ** (32 - p) for four prefixes, then checks three candidate ranges against the office network 10.0.0.0/16 with overlaps(). overlaps() in vpc/network.py is one line on top of Python's ipaddress.ip_network(...).overlaps(...).

🧪 Try it

python3 vpc/demo.py cidr
python3 - <<'EOF'
import sys, ipaddress; sys.path.insert(0, "vpc"); from network import overlaps
for c in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "10.20.0.0/16", "8.8.8.0/24"):
    print(c.ljust(15), "private" if ipaddress.ip_network(c).is_private else "PUBLIC")
for p in (17, 22, 26):
    print(f"/{p}", 2 ** (32 - p))
print(overlaps("10.20.0.0/16", "10.21.0.0/16"), overlaps("10.20.0.0/16", "10.20.200.0/24"))
EOF

✅ Verify — what you should see

cidr prints the four sizes — 65,536, 4,096, 256, 16 — then:

   10.0.0.0/16    vs the office network 10.0.0.0/16: OVERLAPS — pick another range
   10.0.128.0/17  vs the office network 10.0.0.0/16: OVERLAPS — pick another range
   10.20.0.0/16   vs the office network 10.0.0.0/16: no overlap → safe to connect later

Your snippet prints private for the three RFC 1918 ranges and for 10.20.0.0/16, PUBLIC for 8.8.8.0/24; then /17 32768, /22 1024, /26 64; then False True — 10.21.0.0/16 is a neighbour, but 10.20.200.0/24 is inside the campus.

🏁 What you just proved

You can read any prefix as a size, tell a private range from a public one, and catch an overlap before it is built.

⚠️ Common mistakes

10.0.0.0/16 in every account "because the wizard suggested it" — they can never all connect
choosing a range that overlaps the office network, a partner, or the VPN
a VPC that is far too small (a /24 for an EKS cluster — pods take VPC addresses)
using public addresses you do not own as a "private" range
thinking the primary CIDR can be changed later — it cannot; you can only add more

🏭 In production

Large teams keep one IP plan for the whole company — every VPC, every Region, the office, the partners — and hand out ranges from it, usually with IPAM.

On a real account (needs the AWS CLI and credentials; IDs are examples):

aws ec2 create-ipam --operating-regions RegionName=ap-south-1
aws ec2 create-ipam-pool --ipam-scope-id ipam-scope-0123456789abcdef0 \
    --address-family ipv4 --locale ap-south-1
aws ec2 provision-ipam-pool-cidr --ipam-pool-id ipam-pool-0123456789abcdef0 --cidr 10.0.0.0/8
aws ec2 create-vpc --ipv4-ipam-pool-id ipam-pool-0123456789abcdef0 --ipv4-netmask-length 16

⏭️ Next

The campus owns 65,536 house numbers. Now split them into wings, one per building — subnets and AZs, and the 5 numbers AWS keeps in every wing.

git checkout lesson-03-subnets-azs

← Previouswhy vpc Next →subnets azs

This page is the lesson's README from the lesson-02-cidr-ips branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.