IPv4 Network Design: Zoning, Allocation and the Human Factor

1. Security Zoning and Containment

The main purpose of modern subnetting is not address management: it is reducing the blast radius of a security incident. A flat network, such as one large /16 for every employee, is a basic architectural failure, because it lets ransomware or an attacker move sideways across the whole estate without resistance.

The Reality: The Operational Tax

Segmentation has a cost. Every boundary you create needs a firewall rule to let legitimate traffic through. Segment too much and you get firewall fatigue, where frustrated engineers write any to any rules just to get an application working, and the boundary stops meaning anything.

The Balanced Approach

• The DMZ (demilitarised zone) is not negotiable. Public facing services such as web servers and mail gateways belong in isolated subnets, with strict layer 3 and 4 firewall rules blocking access back into the internal LAN.
• Keep users and servers apart. Never put user workstations and servers in the same broadcast domain. Users are the main way in (phishing, downloads); servers hold the data. Separate them with a layer 3 boundary.
• A warning about microsegmentation. Do not try to segment every server on its own unless you have the automation to manage it (VMware NSX, Cisco ACI and the like). Manual microsegmentation at scale becomes unmanageable, and unmanaged rules decay.

2. Allocation Strategy and the Human Factor

Address planning balances room to grow against routing efficiency. The two often pull against each other, but they can live together with some discipline.

Strategy A: The Standard /24

Standardising on a /24 (255.255.255.0) across the LAN layer gives consistency. The mental arithmetic is easy, DHCP scopes look the same everywhere and wildcard masks for ACLs are simple. Try any of it in the subnet calculator.

Strategy B: The Pre-allocated Container

This approach lets you leave gaps for growth (sparse allocation) without breaking route summarisation.

• The method. Reserve a larger block, for example a /22, for one zone, and advertise the whole /22 to the core. Inside the zone, allocate the /24s sparsely: use .0 and .2, leave .1 and .3 free.
• The benefit. The core routing table stays clean with one route, and the zone has room to expand.

The Critical Risk

Containers depend entirely on governance and on disciplined IP address management (IPAM).

• The failure mode. If documentation is weak, an engineer sees an "unused" gap inside a reserved container and provisions it somewhere else entirely.
• The consequence. Traffic follows the summary route to the original container, not the new location. The result is a routing black hole that is notoriously hard to troubleshoot.

3. Isolation: Private VLANs

Sometimes you need to isolate devices, such as guest Wi-Fi clients or untrusted IoT sensors, without spending a separate subnet on each one. Private VLANs (PVLANs) split a broadcast domain into isolated lanes.

The Port Types

• Promiscuous port: given to the gateway. It can talk to everyone.
• Isolated ports: can talk only to the gateway. Devices on them cannot see each other (layer 2 isolation).
• Community ports: can talk to the gateway and to others in the same community.

The Operational Warning

PVLANs make troubleshooting much harder. A junior engineer looking at an ARP table may not understand why device A cannot ping device B when both are on the same subnet and VLAN.

Guidance. Use PVLANs sparingly, for high risk, low management zones such as guest networks and IoT. Do not use them for general server farms unless compliance requires it.

4. The Management Plane and Out of Band Access

The management plane is the crown jewel of the network. Never let management traffic (SSH, the web interfaces of switches and firewalls, hypervisor consoles) cross the same subnet as user data.

Resilience as well as security. Out of band management is not only about keeping attackers away. If a broadcast storm or a denial of service attack saturates the data plane, you need a clean, uncongested path to log in and fix it.

Implementation

• Dedicate a subnet to management, for example 10.0.99.0/24.
• Control access: reach it only from a jump box, a privileged access workstation or a dedicated administrator VPN.
• Prevent VLAN hopping: never allow management VLANs on user facing trunk ports.

5. The VPN Trap and Merger Conflicts

When designing a corporate addressing scheme, avoid 192.168.0.0/24 and 192.168.1.0/24. They are the factory defaults on almost every home router.

The Immediate Conflict

If a remote user's home network is 192.168.1.0/24 and your server VLAN is also 192.168.1.0/24, the VPN client cannot route traffic correctly: the home network wins and the servers become unreachable.

The Future Conflict

Common ranges such as 10.0.0.0/24 or 10.1.1.0/24 store up pain for any future merger. If you join with a company that picked the same easy range, you face a large NAT or readdressing project.

Keep Going

• Work through the maths in the subnet calculator.
• Practise it in the networking quiz.
• Take the free IPv4 Subnetting and Network Design course.
• Read the IPv6 design guide.
• Planning an addressing scheme for real? Send us the brief.

Designing or Reviewing a Network Like This?

Our network and identity design work starts from a diagram and a conversation. Discuss an engagement.