CIDR Overlap Checker

Paste your VNets, VPCs and on-prem ranges. Spot overlaps, map free space.

Write name 10.0.0.0/16, 10.0.0.0/16 name or name: 10.0.0.0/16, 10.1.0.0/16 for a network with several prefixes. A bare IP counts as a /32, and # starts a comment. Lines without an IP (like CSV headers) are skipped.

Cloud checks:
Flags ranges each selected cloud refuses or advises against.

Summary

Address Map — click a range to find it in the table

Used Overlap Free

Overlaps

Range ARange BRelationshipShared Addresses

Ranges

NameCIDRAddressesTypeStatus
🔗 Direct link to this check

Free Space

Where does a new block fit?

The first free blocks of the size you pick, aligned on their boundary and ready to use.

All free space

Everything left unused in each address space, as the fewest CIDR blocks. Sizes vary.

CIDR Overlap FAQ

How can two CIDR blocks overlap?

Two CIDR blocks are either completely separate, identical, or one contains the other. They can’t partly overlap, because every block starts on a boundary of its own size. 10.0.0.0/16 and 10.0.1.0/24 overlap because the /24 sits inside the /16. That’s why this tool reports each overlap as identical or contains.

Can I peer networks with overlapping address spaces?

No, not on the three big clouds. Azure doesn’t allow virtual network peering between virtual networks with overlapping address spaces. AWS can’t create a VPC peering connection between VPCs with matching or overlapping CIDR blocks, even if only one of several blocks overlaps. Google Cloud doesn’t allow subnet ranges to overlap across peered VPC networks. VPN and on-premises links need unique ranges too.

Which address ranges can’t be used in an Azure virtual network?

Azure doesn’t let you add 224.0.0.0/4 (multicast), 255.255.255.255/32 (broadcast), 127.0.0.0/8 (loopback), 169.254.0.0/16 (link-local) or 168.63.129.16/32 (internal DNS, DHCP and Load Balancer health probes) to a virtual network. Keep the Azure check on to flag them.

Which address ranges can’t be used in an AWS VPC?

AWS doesn’t let you use 0.0.0.0/8, 127.0.0.0/8 (loopback), 169.254.0.0/16 (link-local) or 224.0.0.0/4 (multicast) for a VPC, and each VPC CIDR block must be between /16 and /28. AWS also advises against 172.17.0.0/16, which AWS Cloud9 and Amazon SageMaker AI use. For EKS, the Kubernetes service range defaults to 10.100.0.0/16 or 172.20.0.0/16 and must not overlap the cluster’s VPC.

Which address ranges can’t be used in a Google Cloud subnet?

Google Cloud prohibits 0.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 224.0.0.0/4, 255.255.255.255/32, Google’s own public IP addresses and the Private Google Access addresses 199.36.153.4/30 and 199.36.153.8/30. It advises avoiding 10.128.0.0/9, used by auto mode VPC networks (it blocks peering and VPN with them), and 172.17.0.0/16, used by the default Docker bridge network. Subnets must be between /29 and /4, with /8 as a practical maximum.

Why does my AKS service CIDR conflict with my network?

The Kubernetes service range must not overlap the cluster’s virtual network, peered networks or on-premises ranges. With kubenet the default service CIDR is 10.0.0.0/16, which often collides with a VNet that also starts at 10.0.0.0. AKS also rejects 169.254.0.0/16, 192.0.2.0/24, 172.30.0.0/16 and 172.31.0.0/16 for service, pod and cluster virtual network ranges. Add your service and pod CIDRs to the list to check them.

What are the private IPv4 address ranges?

RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private networks. RFC 6598 adds 100.64.0.0/10 as shared address space for carrier-grade NAT, which Azure also treats as private. The Type column labels each range, and in Auto mode the map draws one lane per private range.