Is it advisable to use multiple private addressing schemes on the same lan to be able to tell them apart easily in tcpdump or similar? e.g., fw 10. dmz 172.16. wifi 192.168. Will this cause headaches for me later? What are the unforseen potential problems?


It will not create any problems at all – addresses are just addresses, and IP doesn't care whether they're public or private, nor whether they're from the same base range or different ones.

What it'll create is inconveniences as it makes route aggregation harder or impossible. For example, if all my subnets are 10.147.x.0/24, then I can say "allow" in a firewall rule and that'll match them all in a single rule. But you will need to list different parts of the LAN individually – at minimum you will need three separate entries (one for each private range).

Routing also becomes more complex if you use static routes. Let's say you have a main router, and then a secondary router that has 5 subnets for whatever reason. If they share the same base prefix, the main router only needs to know one aggregate "supernet" route via the secondary router. If they don't, it needs five.

Very similarly, if you wanted to configure a VPN server for reaching your home systems on the go, you would usually tell it to advertise specific network routes to connecting clients. If all your subnets share the same prefix, you only need to configure the VPN server to provide that one prefix – but if they don't, then you have to list every one of your subnetworks.

This is actually related to how subnetting was invented. At first, IP networks only had 3 sizes ('subnets' and 'netmasks' did not exist), but organizations soon found it very inconvenient that they needed to request multiple /24's (then known as "class C's") to represent different parts of their large network. When subnetting was introduced, they became able to request just a single /16 range (a "class B") and subdivide it internally.

  • Very thoughtful and detailed answer, thank you. This is my proposed network rollout postimg.cc/qzy774xB as you can see I have five network segments, with five gateways. You are saying each one will have a different representation of the network in the routing table and that will be/become a PITA to maintain and aggregate to all the hosts. A nightmare in short. I will revise my network map using a 10. scheme. Thank you. Aug 29 '20 at 17:57

What you are doing will work, but honestly, you're making your address scheme way too complicated.

Just use the 10.x.x.x network and cut it up into class-C segments. Something like: fw - 10.1.1.x/24 vpn - 10.2.2.x/24 dmz - 10.3.3.x/24 lan - 10.4.4.x/24 wifi -10.5.5.x/24

That would give you 256 addresses per subnet to tinker with and using easy 10.1-2-3-4-5 numbering will make it easy to remember at a glance where you are.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.