Want a specific public/private split — e.g. 6 subnets, 2 public and 4 private? Enter the counts and apply: resizes to the smallest equal-size split that fits both (2 + 4 → 8 subnets), then tags the first as Public and the rest as Private.
| # | Subnet (CIDR) | Role | Usable Range | Total IPs |
Usable Hosts |
AWS & Azure Usable Hosts |
OCI Usable Hosts |
|---|
- AWS & Azure both reserve 5 addresses per subnet — AWS: network, VPC router, DNS at .2, one reserved for future use, broadcast; Azure: network, default gateway at .1, DNS at .2–.3, broadcast. Shown only where a subnet size is valid on both (AWS allows /16–/28, the narrower of the two ranges).
- OCI reserves 3 addresses per subnet (the first two addresses, the last address). Valid for subnet sizes /16–/30.
Rows outside the valid subnet-size range show —.
Export to Terraform / CloudFormation
Tag subnets above as Public or Private, then generate ready-to-review subnet resources — a shared public route table, an optional Internet Gateway, and NAT Gateway(s) with private routing, per the strategies below. Security groups, NACLs, and VPC endpoints are not included; wire those into your own stack.
Single puts one NAT Gateway in one AZ — a dependency for every private subnet, plus cross-AZ transfer.
Regional (AWS, Nov 2025+) is one NAT Gateway that spans every AZ automatically — it doesn’t need a public subnet to live in, but this dropdown still requires at least one tagged Public before offering it, since it forces an Internet Gateway to be created too.
Per AZ is the classic pattern: one gateway per zone.
Create requires at least one Public subnet — disabled otherwise. Switches there automatically the first time you tag one; pick it yourself afterward and it stays put, unless every Public subnet gets untagged again, which resets this back to None.
Also locked to Create while NAT strategy is Regional: that NAT Gateway can’t route out without one.
Same idea as AWS’s own “Auto-generate tag” in the VPC console: this value becomes the start of every resource’s Name tag, subnets included.
app → app-vpc, app-public-1,
app-private-1, app-igw, app-public-rt,
app-nat-…, app-private-rt-…
Attach references the City’s one Transit Gateway
(tgw-0ad0dcfaac58969ac, in the network/hub account) — this
tool never creates one. Attaches only the subnets tagged
Private; Public subnets are never eligible.
Disabled until there’s at least one Private subnet, and
the base network is inside 10.240.0.0/16 — every VPC
attached to the Transit Gateway must be, to avoid overlapping with on-prem
and other AWS accounts/VPCs.
Routes 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and the City’s on-prem 156.74.0.0/16 through the attachment in every Private route table, alongside whatever NAT route is already there.