Worked example
A /30 provides two traditional usable endpoints; a /31 provides two RFC 3021 peer addresses without network and broadcast waste.
BGP VPN Subnet Generator
Generate point-to-point subnets for route-based IPsec VPNs and BGP peering. Easily split IP pools into Local and Remote endpoints, including CVI and NDI assignments for HA firewall clusters.
Configuration
Why use 169.254.0.0/16 for VPNs?
The 169.254.0.0/16 subnet is officially designated as Link-Local IPv4 address space. In the context of route-based VPNs (especially in cloud environments like AWS, Azure, and GCP), it is the "gold standard" for Virtual Tunnel Interfaces (VTIs) because:
- It avoids overlapping with your internal RFC 1918 networks (e.g.
10.0.0.0/8,192.168.0.0/16). - It is non-routable on the public internet, adding a layer of implicit isolation.
- Most modern routers and cloud gateways expect BGP to peer over APIPA/Link-Local addresses across IPsec tunnels.
Which subnet mask should I choose?
- /30: The traditional and most universally supported mask for point-to-point links. It provides 4 IPs (1 Network, 2 Usable for Local/Remote, 1 Broadcast).
- /31: Defined in RFC 3021 specifically for point-to-point links. It removes the network and broadcast addresses, providing exactly 2 usable IPs, thus saving IP space.
- /29: Provides 6 usable IPs. Commonly used when setting up HA (High Availability) VPNs with clustered firewalls (like Forcepoint). It allows assigning Cluster Virtual IPs (CVI) and Node Dedicated IPs (NDI) for both ends.
- /28: Provides 14 usable IPs. Used for larger multi-node firewall clusters where each gateway needs its own dedicated IP on the tunnel subnet.
How to use BGP VPN P2P Generator
Allocate aligned point-to-point transit networks and endpoint addresses for VPN and BGP peerings.
Common mistake
Confirm both devices support /31 point-to-point addressing before choosing it.