16

I've been using 192.168.1.x for my home network, which has been perfectly happy for quite some time. However, I just started a new job, and they use the same set of IP addresses when I connect over the VPN.

Naturally, this causes problems.

What other IP address ranges can (and should) I use to prevent conflicts? Would it be OK to use 192.168.2.x... or 42.x ;) ?

I know at one point my brother had setup our network to use 10.0.0.x - but when I used a traceroute program it would say that all of our packets were going to Brazil or something.

Are there other IP addresses reserved for internal networks that I should use?

  • 1
    I generally recommend that folks with home networks just use 192.168.XX.0/24 where XX is between 10 and 245. perhaps the last two digits of the year of your birth? Any number in that range works. "69 dudes!" -- Bill S Preston Esqr and "Ted" Theodore Logan – Frank Thomas Apr 24 '15 at 12:50
  • 17
    @DavidGrinberg Hopefully, you'll never need to visit that range then. That range is assigned to a company called Xerox. – phyrfox Apr 24 '15 at 14:25
  • 11
    If 10.0.0/24 traffic is going to Brazil, your ISP is doing something very weird, and you should call them out on it. Except with special arrangements between the parties involved, 10/8 (like the other RFC 1918 ranges) is supposed to never make it past the egress router of a network. – a CVn Apr 24 '15 at 17:17
  • @MichaelKjörling, the exception is that as an ISP client, you are considered to be part of their private network. So, if the ISP's network spans internationally (such as Brazil) you can potentially reach a 10.0.0.0/8 address in another country. While it is generally good design to minimize this exposure to clients, this is an increasing trend as ISPs run out of PI IP space to use on their internal networks. – YLearn Apr 24 '15 at 18:14
  • Very weird IMO for your company to be using 192. 172 or 10 are typical in companies with any kind of knowledgeable IT department. – paqogomez Apr 24 '15 at 22:22
36

You can freely use any Private Network Address within the following reserved ranges:

  1. Private Address Space

The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets:

    10.0.0.0        -   10.255.255.255  (10/8 prefix)
    172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
    192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

(from RFC 1918 - Address Allocation for Private Internets)


You'll also want to keep in mind the network Host Address and Broadcast Address:

  1. Broadcast IP Addressing - Proposed Standards

If different IP implementations are to be compatible, there must be a distinguished number to denote "all hosts".

Since the local network layer can always map an IP address into data link layer address, the choice of an IP "broadcast host number" is somewhat arbitrary. For simplicity, it should be one not likely to be assigned to a real host. The number whose bits are all ones has this property; this assignment was first proposed in. In the few cases where a host has been assigned an address with a host-number part of all ones, it does not seem onerous to require renumbering.

The address 255.255.255.255 denotes a broadcast on a local hardware network, which must not be forwarded. This address may be used, for example, by hosts that do not know their network number and are asking some server for it.

Thus, a host on net 36, for example, may:

  • broadcast to all of its immediate neighbors by using 255.255.255.255

  • broadcast to all of net 36 by using 36.255.255.255

(Note that unless the network has been broken up into subnets, these two methods have identical effects.)

If the use of "all ones" in a field of an IP address means "broadcast", using "all zeros" could be viewed as meaning "unspecified". There is probably no reason for such addresses to appear anywhere but as the source address of an ICMP Information Request datagram. However, as a notational convention, we refer to networks (as opposed to hosts) by using addresses with zero fields. For example, 36.0.0.0 means "network number 36" while 36.255.255.255 means "all hosts on network number 36".

(from RFC 919 - Broadcasting Internet Addresses)


Additionally, you'll want to understand Classless Inter-Domain Routing (commonly referred to as CIDR) and its CIDR notation for expressing IP address ranges:

Classless Inter-Domain Routing (CIDR, /ˈsaɪdər/ or /ˈsɪdər/) is a method for allocating IP addresses and IP routing. The Internet Engineering Task Force introduced CIDR in 1993 to replace the previous addressing architecture of classful network design in the Internet. Its goal was to slow the growth of routing tables on routers across the Internet, and to help slow the rapid exhaustion of IPv4 addresses.


CIDR notation is a compact representation of an IP address and its associated routing prefix. The notation is constructed from an IP address, a slash ('/') character, and a decimal number.

The address may denote a single, distinct interface address or the beginning address of an entire network. The maximum size of the network is given by the number of addresses that are possible with the remaining, least-significant bits below the prefix. The aggregation of these bits is often called the host identifier.

For example:

  • 192.168.100.14/24 represents the IPv4 address 192.168.100.14 and its associated routing prefix 192.168.100.0, or equivalently, its subnet mask 255.255.255.0, which has 24 leading 1-bits.
  • the IPv4 block 192.168.100.0/22 represents the 1024 IPv4 addresses from 192.168.100.0 to 192.168.103.255.
  • the IPv6 block 2001:db8::/48 represents the block of IPv6 addresses from 2001:db8:0:0:0:0:0:0 to 2001:db8:0:ffff:ffff:ffff:ffff:ffff.
  • ::1/128 represents the IPv6 loopback address. Its prefix length is 128 which is the number of bits in the address.
  • 4
    yes you put that well, though dot 0 is the network address, and dot 255 the broadcast which he may use but he wouldn't assign. – barlop Apr 24 '15 at 14:01
  • 6
    @barlop Addresses ending in .0 and .255 do not indicate the network and broadcast addresses respectively, except in the very specific case where the IPv4 subnetwork ("subnet") mask is exactly 24 bits long. 24-bit netmask length (netmask 255.255.255.0) is a common setup for private networks, but it is not necessary and in fact "classful" IP address assignment has been deprecated since the mid-1990s. These days all IPv4 assignments are CIDR. – a CVn Apr 24 '15 at 17:14
  • 2
    Note: the "private networks" above refers to private residential networks. (Grace period ran out and I'd rather not delete the comment now.) Corporate networks may very well require a shorter netmask to accomodate all the hosts that need to be on a given subnet. – a CVn Apr 24 '15 at 17:19
  • 3
    @barlop the point is that your statement above is misleading. Take 192.168.0.0/23 for example. Your statement above would lead someone to think that 192.168.0.255 would be the broadcast address when this is a valid host address and the broadcast address is actually 192.168.1.255. Similarly, 192.168.1.0 is not a network address but a valid host address. The only time a .0 is always a network address and a .255 is always a broadcast address is a /24. – YLearn Apr 24 '15 at 18:17
  • 2
    @barlop A smaller-than-/24 is the common globally-routable assignment for leaf sites these days. 10+ years ago I administered two separate IPv4 networks which had been assigned globally routable IPv4 addresses, one /27 and one /28 (same ISP, same customer, different sites). The public netblock at my current workplace is similar; I don't recall exactly, but I think it's a /28. Your initial comment said that "dot 0 is the network address, and dot 255 the broadcast", which holds if and only if the netmask is /24. For any other case, the statement is either (a) misleading or (b) outright false. – a CVn Apr 24 '15 at 18:39
7

The 192.168.1.1 IP address used by many home routers is an IANA-reserved private network address or subnet.

What's a subnet? An entire range of IP addresses that you can split up into a smaller ranger (the act of splitting it up is called subnetting) if you want.

So the above range is 192.168.0.0/16. Keeping it simple without getting too much into the individual bits, each "octet" or individual number in the address is 8 bits, and the ones that are "yours" start from the right. So that means the last two octets (16 bits) are yours to do whatever you want. So you can use all the IP addresses from 192.168.0.1 to 192.168.255.254 (the first one is reserved and the last one is a broadcast address) really in any way you want and your router allows.

The simplest route usually taken in this situation is to use the "sub-subnet" 192.168.0.0/24 or 192.168.1.0/24. Using 192.168.0.0/24 as an example, this means your home network can use any IP address from 192.168.0.1 through 192.168.0.254, with 192.168.0.255 being the broadcast address.

But you are free to change the subnet, since you have two numbers that are really "yours", so you can use 192.168.44.0/24 or any other number for the second octet. Just keep in mind that everything that needs to see each other on the network needs to be on the same subnet (i.e. within that subnet's range of IP addresses). So your router's IP address needs to appear in that subnet (good choice is 192.168.44.1), and your router needs to give out DHCP addresses from a range in that subnet (say something like 192.168.44.10 through 192.168.44.50).

Nothing is really stopping you from using 192.168.0.0/16 for your home router either, but it's good practice to leave some room for additional networks or changing things in the future.

  • 1
    I would say this is the should and @FranciscoTapia is the can [of the answers title can/should] – Austin T French Apr 24 '15 at 13:21
  • @AthomSfere i think you are absolutly right. – Francisco Tapia Apr 24 '15 at 14:05
  • 2
    You've got the subnet mask lengths backwards. /8 gives you 24 bits host. You want /24 which gives you 8 bits host (32 total minus 8 and 24 for network, respectively). 192.168/16 is RFC 1918 space, anything less (longer subnet mask) which fully fits within that range is thus also 1918 space. – a CVn Apr 24 '15 at 17:25
  • Thanks for pointing out the total derp on my part, fixed. – LawrenceC Apr 24 '15 at 19:20
  • @AthomSfere Can you elaborate on why this is the "should"? – Jon Bentley May 8 '15 at 12:20
1

Yes, you would be OK using .2.x, and that would not cause any problems, however make sure your netmask is set to 255.255.255.0 and not 255.255.0.0 because it would try to mix your .2.x with your vpn .1.x as if it was the same network.

1

I know this is an old question, and some answers above are correct.

To put it simply, the Internet Assigned Numbers Authority (IANA) established three blocks of the IP address space for private networks:10.0.0.0 – 10.255.255.255, 172.16.00 – 172.31.255.255, 192.168.0.0 – 192.168.255.255.

The third IP address that you used is enough for most users for connecting up to 254 devices. So it have been commonly used till today.

Note that there is really nothing wrong from using a 10.0.0.0 or 172.16.00.

  • 2
    The third IP address that you used is enough for most users for connecting up to 254 devices. Not quite. It is enough for a lot more devices. (2^16-2, aka 65534 devices, not just 2^8-2 aka 254). – Hennes Jul 22 '16 at 9:17
1

The reason why you should use private addresses in those ranges in your internal networks, is because these are the addresses that are not used on the internet for real networks.

In fact backbone routers won't forward in general packets for these addresses (although some ISPs actually dish out private IPs to customers, in this case you'll be going through their NAT).

If you choose another range of addresses for your network, which are public addresses, in use somewhere else in the internet, then you lose accessibility to those other addresses, due to local routes to those destinations overriding default routing to the real remote network.

  • Correct. You can do that just fine, but you need to make sure those IPs belong to you (and by that also not to someone else on the Internet). That used to be the way that the Internet worked before we ran out if IPv4 addresses. These days home users are forced to use NAT, and thus RFC1918 or some clever routing and loose access to a few devices on the Internet. – Hennes Jul 22 '16 at 9:21
  • I hate to think how many people can't access the 1.2.3.0 network over the internet. We saw a lot of customers use this range over the years on their internal networks. – Adrien Jul 22 '16 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.