3 Cloud Networking Math Traps That Break Production (and a Zero-Upload Workbench)

Umix — Sat, 14 Nov 2026 05:23:50 +0000

Every time I design a multi-tier cloud VPC, debug a hung WireGuard tunnel, or compress sprawling firewall rules, I end up needing quick subnet or MTU math.

Most calculators on page one of search results haven't changed since 2008: they assume classic RFC -2 host math, ignore cloud provider reservations, or upload pasted JWT bearer tokens and configs to a backend server.

Here are 3 networking math traps that regularly bite engineers in production—plus NetDevKit, a fast, 100% client-side browser workbench I built to solve them offline.

1. The AWS & Azure `/28` Subnet Surprise (`11` IPs, Not `14`)

Under classic RFC 950 subnetting, a /28 block (16 total IPv4 addresses) gives you 14 usable hosts. Cloud VPCs reserve extra control-plane addresses inside every subnet:

Environment	Reserved IPs	Usable Hosts in `/28`	What's Reserved?
Standard RFC	`2`	14	`.0` Network, `.15` Broadcast
Google Cloud (GCP)	`4`	12	Network, `.1` Gateway, Penultimate IP, Broadcast
AWS VPC / Azure VNet	`5`	11	`.0` Net, `.1` Router, `.2` DNS, `.3` Future, Broadcast

During rolling Kubernetes node upgrades or multi-AZ RDS failovers, those missing IPs routinely trigger InsufficientFreeAddressesInSubnet errors.

Try it live (pre-filled /28 in AWS VPC mode + Terraform snippet):

IPv4 Subnet & Cloud VPC Calculator →

2. WireGuard Over PPPoE Hanging on `TLS ClientHello`

ping works across the VPN tunnel, SSH connects, and then curl https://... or git clone freezes indefinitely.

That is a classic Path MTU Discovery (PMTUD) blackhole:

Standard Ethernet (1500) minus IPv6 WireGuard overhead (80 bytes) = 1420 MTU
Behind residential PPPoE (8 bytes overhead, 1492 WAN MTU), your safe ceiling drops to 1412 bytes (TCP MSS = 1372 for IPv4 / 1352 for IPv6)

When upstream firewalls drop ICMP Fragmentation Needed packets, large TLS handshakes stall silently unless you clamp TCP MSS on forward chains:

nft add rule inet filter forward tcp flags syn tcp option maxseg size set rt mtu

Calculate exact tunnel overhead & split-tunnel configs:

MTU, TCP MSS & VPN Overhead Calculator →

WireGuard AllowedIPs & Peer Config Builder →

3. Firewall Exact Merging vs. BGP Supernets

Summarizing routes for BGP/OSPF is very different from compressing CIDR lists to fit inside AWS Security Group quotas (60 rules per group by default):

Firewall / Security Group compression requires Exact Merge (0 unallocated gap IPs exposed to external traffic).
BGP route aggregation uses a Single Umbrella Supernet (which spans intermediate gaps and requires a Null0 discard route to prevent routing loops).

Audit & merge CIDR lists locally in your browser:

CIDR Route Summarization & AWS Security Group Merger →

Multi-Cloud VPC & Kubernetes CIDR Overlap Checker →

What Else Is Inside the Workbench?

Everything on NetDevKit runs 100% locally in vanilla JS & WebCrypto—zero server uploads, dark mode, shareable links, and one-click CLI/Terraform copy:

IP & Routing: IPv4/Cloud VPC, VLSM Splitter (CSV export), IPv6 Compression, CIDR Merger, VPC Overlap Checker
VPN & Security: WireGuard Config Builder, Tunnel MTU/MSS Calculator, SPF & DMARC DNS Generator
DevOps & Crypto: Offline JWT Expiry Inspector, JSON/Base64 Formatter, WebCrypto SHA-256/SHA-512 & URL Encoder, Cron Simulator, Linux chmod/Umask, Log Regex Matcher

Next up on my list: LLM GPU VRAM & KV-Cache Sizing and AWS EKS ENI Pod IP Capacity.

What infrastructure calculator or config generator do you wish existed without popups or server uploads? Let me know in the comments!

DEV Community: Umix

3 Cloud Networking Math Traps That Break Production (and a Zero-Upload Workbench)

1. The AWS & Azure /28 Subnet Surprise (11 IPs, Not 14)

2. WireGuard Over PPPoE Hanging on TLS ClientHello

3. Firewall Exact Merging vs. BGP Supernets

What Else Is Inside the Workbench?

1. The AWS & Azure `/28` Subnet Surprise (`11` IPs, Not `14`)

2. WireGuard Over PPPoE Hanging on `TLS ClientHello`