3 Cloud Networking Math Traps That Break Production (and a Zero-Upload Workbench)

Every time I design a multi-tier cloud VPC, debug a hung WireGuard tunnel, or compress sprawling firewall rules, I end up needing quick subnet or MTU math.

Most calculators on page one of search results haven't changed since 2008: they assume classic RFC -2 host math, ignore cloud provider reservations, or upload pasted JWT bearer tokens and configs to a backend server.

Here are 3 networking math traps that regularly bite engineers in production—plus NetDevKit, a fast, 100% client-side browser workbench I built to solve them offline.

1. The AWS & Azure /28 Subnet Surprise (11 IPs, Not 14)

Under classic RFC 950 subnetting, a /28 block (16 total IPv4 addresses) gives you 14 usable hosts. Cloud VPCs reserve extra control-plane addresses inside every subnet:

During rolling Kubernetes node upgrades or multi-AZ RDS failovers, those missing IPs routinely trigger InsufficientFreeAddressesInSubnet errors.

Try it live (pre-filled /28 in AWS VPC mode + Terraform snippet):

IPv4 Subnet & Cloud VPC Calculator →

2. WireGuard Over PPPoE Hanging on TLS ClientHello

ping works across the VPN tunnel, SSH connects, and then curl https://... or git clone freezes indefinitely.

That is a classic Path MTU Discovery (PMTUD) blackhole:

• Standard Ethernet (1500) minus IPv6 WireGuard overhead (80 bytes) = 1420 MTU
• Behind residential PPPoE (8 bytes overhead, 1492 WAN MTU), your safe ceiling drops to 1412 bytes (TCP MSS = 1372 for IPv4 / 1352 for IPv6)

When upstream firewalls drop ICMP Fragmentation Needed packets, large TLS handshakes stall silently unless you clamp TCP MSS on forward chains:

nft add rule inet filter forward tcp flags syn tcp option maxseg size set rt mtu

Calculate exact tunnel overhead & split-tunnel configs:

• MTU, TCP MSS & VPN Overhead Calculator →
• WireGuard AllowedIPs & Peer Config Builder →

3. Firewall Exact Merging vs. BGP Supernets

Summarizing routes for BGP/OSPF is very different from compressing CIDR lists to fit inside AWS Security Group quotas (60 rules per group by default):

• Firewall / Security Group compression requires Exact Merge (0 unallocated gap IPs exposed to external traffic).
• BGP route aggregation uses a Single Umbrella Supernet (which spans intermediate gaps and requires a Null0 discard route to prevent routing loops).

Audit & merge CIDR lists locally in your browser:

• CIDR Route Summarization & AWS Security Group Merger →
• Multi-Cloud VPC & Kubernetes CIDR Overlap Checker →

What Else Is Inside the Workbench?

Everything on NetDevKit runs 100% locally in vanilla JS & WebCrypto—zero server uploads, dark mode, shareable links, and one-click CLI/Terraform copy:

• IP & Routing: IPv4/Cloud VPC, VLSM Splitter (CSV export), IPv6 Compression, CIDR Merger, VPC Overlap Checker
• VPN & Security: WireGuard Config Builder, Tunnel MTU/MSS Calculator, SPF & DMARC DNS Generator
• DevOps & Crypto: Offline JWT Expiry Inspector, JSON/Base64 Formatter, WebCrypto SHA-256/SHA-512 & URL Encoder, Cron Simulator, Linux chmod/Umask, Log Regex Matcher

Next up on my list: LLM GPU VRAM & KV-Cache Sizing and AWS EKS ENI Pod IP Capacity.

What infrastructure calculator or config generator do you wish existed without popups or server uploads? Let me know in the comments!