Lesson 7 of 7
Special Ranges and Design Rules
The maths is done. This lesson is about judgement: the ranges you must recognise on sight and the addressing choices you will thank yourself for later.
Training is free for members. We are checking whether you are signed in; if you are not, we will take you to sign in and bring you straight back here. Nothing happening? Register or sign in with a code we email you.
Ranges to Know on Sight
| Block | What It Is |
|---|---|
10.0.0.0/8
|
Private (RFC 1918) |
172.16.0.0/12
|
Private (RFC 1918) |
192.168.0.0/16
|
Private (RFC 1918) |
100.64.0.0/10
|
Shared address space, carrier grade NAT (RFC 6598) |
169.254.0.0/16
|
Link local (169.254.0.0/16) |
127.0.0.0/8
|
Loopback (127.0.0.0/8) |
192.0.2.0/24
|
Documentation (TEST-NET-1, RFC 5737) |
198.51.100.0/24
|
Documentation (TEST-NET-2, RFC 5737) |
203.0.113.0/24
|
Documentation (TEST-NET-3, RFC 5737) |
224.0.0.0/4
|
Multicast (224.0.0.0/4) |
240.0.0.0/4
|
Reserved (240.0.0.0/4) |
Only the three RFC 1918 blocks are yours to use freely inside a network. 100.64.0.0/10 belongs to service providers for carrier grade NAT, and the documentation blocks are for examples and training, never for live networks.
Point to Point Links and Loopbacks
-
A link between two routers needs two addresses. A
/30gives exactly two usable hosts; a/31(RFC 3021) uses both of its addresses, so10.53.255.0/31gives10.53.255.0and10.53.255.1and wastes nothing. -
A loopback is one address: a
/32. Give every router one from a dedicated block so they are easy to find and to filter.
Choices That Age Well
- Zone first, then address. Users, servers, the DMZ and management each get their own subnets with a layer 3 boundary between them. Subnets with filtering between them limit how far an incident spreads.
- Keep management apart. A dedicated management subnet, reachable only from a jump host or an administrator VPN.
- Avoid the home router ranges. 192.168.0.0/24 and 192.168.1.0/24 clash with remote workers' home networks over the VPN. Pick ranges from 10.0.0.0/8 at random, for example 10.53.10.0/24, and mergers get easier too.
- Leave room, in the right place. Reserve a larger block per site or zone and summarise it, but only with an IPAM tool everyone uses.
Each of these is covered in more depth in our IPv4 design guide. Planning a scheme for real? Our network design work starts with a diagram and a conversation.
Practice
5 questions, new each time. Every answer is worked out by the same library as our subnet calculator, so if one looks wrong, check your working first and then tell us.