For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

VPC subnets add IP address ranges to a VPC network as separate, named segments. Routes determine how traffic from a VPC or subnet reaches destinations, such as other subnets, NAT gateways, or Droplets acting as network appliances.

You can manage subnets and routes using the DigitalOcean API. The Control Panel does not support them yet. See How to Manage VPC Subnets and How to Manage Routes. When choosing CIDRs for a VPC network or its subnets, see How to Plan Your Custom VPC Network.

Subnets

A subnet is a distinct IP range within a VPC network. A subnet does not divide the VPC’s existing IP range; it adds address capacity to the network. You can use subnets to segment resources by workload, environment, or team, and apply routing rules to each subnet independently.

Each VPC network has a default subnet that covers the VPC’s initial IP range. Additional subnets have the following requirements:

• The IP range must be an RFC 1918 CIDR with a prefix length between /16 and /28.
• The IP range cannot overlap with the IP range of any other subnet on your team. Every IP range in a VPC belongs to a subnet, including the default subnet that covers the range you chose when you created the VPC, so this also prevents overlap with other VPC networks.

Resources such as Droplets, DigitalOcean Kubernetes (DOKS) clusters, Load Balancers, and NAT gateways are members of a subnet. During the public preview, you can choose a subnet when you create a Droplet, DOKS cluster, Load Balancer, or NAT gateway. You can list a subnet’s members and filter them by resource type.

Subnets have a type field. Subnets you create are REGULAR subnets. Some DigitalOcean products create managed subnets to support their own networking. You cannot modify managed subnets or their routes.

Routes

Routes exist at two scopes:

• VPC-scoped routes apply to the entire VPC network. These routes are read-only in the API. DigitalOcean manages them on your behalf, for example when you create a subnet in the VPC.
• Subnet-scoped routes apply to a single subnet, such as NAT gateway routes and static routes that target a Droplet. A subnet’s effective routing combines the VPC-scoped routes propagated into the subnet with any routes defined on the subnet itself.

Routes also have a type field:

• STATIC routes have a fixed destination and target. This includes routes you create on a subnet and routes DigitalOcean creates for products such as VPC peering.
• DYNAMIC routes are learned from external networks, such as routes learned through Partner Network Connect. You cannot modify dynamic routes directly. No dynamic routes exist during the public preview.

Each route includes a modifiable field that indicates whether you can update or delete it. A route is modifiable only when all of the following are true:

• The route is scoped to a subnet, not the VPC.
• The route is a STATIC route that you created.
• The route’s target is a resource type you manage directly, such as a Droplet.

Static routes that DigitalOcean products create and manage, such as DOKS routes, are not modifiable even though they appear as STATIC in the API.

A static route consists of a destination CIDR and a target URN. The target_urns field accepts a list, but routes currently support only one target. For example, a route with destination 0.0.0.0/0 and target do:droplet:<droplet-id> sends the subnet’s outbound traffic through a Droplet, such as a self-managed firewall or VPN gateway.

Limits

• VPC-scoped routes and DYNAMIC routes cannot be created, updated, or deleted through the API.
• No DYNAMIC routes exist during the public preview.
• Routes managed by DigitalOcean products, such as DOKS, cannot be modified even when their type is STATIC.
• Static routes support one target URN per route.