I've been studying subnetting and of course there's plenty I'm confused about. One issue is as follows: my company uses AWS. For our VPC let's say we have a private network address of /16 CIDR. My question is this: I have a feeling that they can offer this private address to other companies as well. How is this possible? I realize I'm confused about something deeper, but then again, that's precisely why I'm asking this question. Thanks!


It's exactly the same way that any company can use, and reuse, the same private addresses. The private addresses don't get routed where they can conflict with each other.

I my company uses private addresses internally, and your company uses the same private addresses internally, there is no conflict since our two companies can only communicate through a different network, and the same private addresses in each company get translated to different addresses before reaching the other company.

A single company can do the same thing internally. NAT is not just to connect to the Internet, it can be used inside a company, too.

| improve this answer | |
  • So in other words the private addresses aren't 'sitting' on the internet? – Dimpermanence Jan 11 '16 at 18:19
  • Private addresses cannot be routed on the Internet. Only public addresses will be routed on the Internet. – Ron Maupin Jan 11 '16 at 18:22
  • Thanks, Ron! That makes a lot of sense. I vow to learn more about routing! – Dimpermanence Jan 11 '16 at 18:23
  • What did you mean when you said, "Nat is not just to connect to the Internet, it can be used inside a company, too,"? – Dimpermanence Jan 11 '16 at 18:29
  • There are all sorts of use cases for NAT within a company. For instance, your company and mine both use the same private addressing range when we decide to merge. It could take a very long time to re-address one or the other company. We could NAT between the to formerly separate companies. – Ron Maupin Jan 11 '16 at 18:38

I don't know exactly how amazon does it but I can easilly see a few ways to engineer this.

The key thing to remember is that IP addresses only matter to IP routers and endpoints. An ethernet switch with VLANSs doesn't care if VLAN1 and VLAN2 have overlapping IP ranges, all it cares about is which vlan the packet is on and which MAC address it is flowing between. So if each companies virtual private cloud has it's own VLANs and it's own routers connecting those VLANs then it's not a problem for those virtual clouds to have overlapping IP space.

I belive some big router vendors have routers that can be partitioned into multiple logically independent routers but I can't seem to find a good source right now. Linux can do the same thing through the use of "network namespaces".

Or of course you could just use software routers (either the built in routing facilities in major operating systems or something from a router vendor) and run them inside VMs.

Or you could even have no routers on the cloud side at all and just have the cloud network tunneled back to your own network.

| improve this answer | |

The real way this is done in Amazon is different from how you might imagine, as common solutions don't scale. They did a talk in 2013 about this at re:Invent, which you can watch on YouTube:


However, the more general answer is "IP addressing is a matter of perspective." More specifically, if your hosts never want to talk to the hosts of someone else who was allocated the same IP space, no one cares that you have the same IP addresses. If you do, and you want to talk to each other, then through the use of some mechanism like NAT, you will change the IP addresses of the the hosts in network A from the perspective of network B.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.