AWS reserves the first four and the last IP address in every subnet CIDR block for internal networking purposes. These are: the Network address (Base + 0) used to identify the network; the VPC router (Base + 1) for routing traffic; the DNS server (Base + 2) for resolving internal domain names; an address reserved for future use (Base + 3); and the Network broadcast address (Last IP) which is reserved even though AWS doesn't support broadcast traffic. For example, in a 10.0.0.0/24 subnet, 10.0.0.0, 10.0.0.1, 10.0.0.2, 10.0.0.3, and 10.0.0.255 are unavailable.