Last reviewed: May 2026
Both /28 and /29 are common choices, and the right one depends less on host counts than on where the block sits in your wider plan. Here is the direct comparison, then the practical guidance.
| Prefix | Total IPs | Usable (standard) | AWS usable | Azure usable | GCP usable | Typical use |
|---|---|---|---|---|---|---|
| /28 | 16 | 14 | 11 | 11 | 12 | Smallest AWS/Azure subnet allowed |
| /29 | 8 | 6 | n/a | n/a | n/a | On-prem only — below cloud minimums |
AWS and Azure reserve 5 addresses per subnet; GCP reserves 4. Those columns are what you can actually assign to workloads.
Any cloud subnet that needs to be small. A /28 is the floor on both AWS and Azure — you cannot create anything smaller — so it is the correct choice for NAT gateway subnets, VPC endpoint subnets and small management tiers.
On-premises and lab networks only. A /29 gives six usable addresses, which suits a small DMZ or a rack of infrastructure devices, but AWS and Azure both reject it. Reaching for a /29 in a cloud plan is a sign the plan was written against textbook subnetting rather than provider rules.
Prefix choice is a downstream decision. Start from the VPC or VNet block, divide it per region and per availability zone, and only then choose subnet sizes. The Cloud VPC & VNet CIDR Planning Guide covers that top-down process, and the free subnet finder will tell you which of these sizes actually fits in the space you have left.
Neither is better in the abstract. A /28 has more usable addresses and a /29 conserves address space. Choose based on expected host count, provider minimums for the service involved, and how much room the parent block has left.
Exactly 2, because the prefix difference is 1 bit and 2^1 = 2.
Both reserve five addresses in every subnet: the network address, the default gateway, two for internal DNS and future use, and the broadcast address. GCP reserves four. A /28 therefore yields fewer assignable addresses in cloud than the textbook figure.