In a subnet you may have addresses allocated for a number of reasons.
- The network and broadcast address, which are essentially wasted.
- Addresses for hosts that need full access to the internet.
- Addresses for hosts that need outbound connection to the internet but don't need incoming from the internet.
- Addresses for hosts that don't need internet access at all.
- Addresses for routers on the network
- Addresses kept for future expansion
- Addresses unused because the subnet must have a power of two size.
So lets say we have a subnet with.
- A couple of webservers that serve webpages to the public internet.
- A couple of database servers that provide the databases for the webservers.
- A couple of servers that download data from another site for processing.
- A redundant pair of gateways to the outside world with a virtual IP to serve as the default gateway.
That adds up to 9 addresses, 6 for the servers, 2 for the physical gateways, 1 for the virtual gateway IP. To actually allocate an address block to the subnet we also need a network and broadcast address taking the total to 11. The next power of 2 after 11 is 16.
So if we address the subnet with public IPs directly then we need a block of at least 16 public IPs, if we want to allow for future expansion we may want to allocate a bigger block, say 32 public IPs.
Yet only two of the addresses on the subnet actually need to be reachable from the Internet. The rest could manage just fine behind a one to many NAT or don't need connectivity to the public internet at all.
Scale this up to a larger network and you can save a massive number of public IP addresses by allocating individual public addresses to the machines that actually need them rather than allocating big blocks of public IPs to subnets.
There are a couple of ways to do this, one is to use secondary IP addresses on the servers with static /32 routes to deliver traffic to them. Another is to use Static NAT to map the public IP addresses to private ones at the network border. There are pros and cons to both approaches.