Planning your address space
Address plans are made once and lived with for years. Twenty minutes of thought now saves a renumbering later.
Leave gaps on purpose
The commonest mistake is allocating consecutively: the first project gets
10.0.0.0/24, the second 10.0.1.0/24, and when the first
needs to grow there is no room next to it.
Allocate sparsely. Give each environment or site a large block and use the bottom of
it. Private space is free and you have 16 million addresses in
10.0.0.0/8 — being frugal with it has no upside at all.
A layout that stays readable
Encode meaning in the digits so an address tells you what it is:
10.0.x.x— production10.1.x.x— staging10.2.x.x— management and monitoring
and within each, a byte for role: .10. web, .20. database,
.30. storage. 10.0.20.5 then reads as “production,
database, number five” without a lookup.
Match the VLAN id to the second or third octet where you can — VLAN 20 carries
10.0.20.0/24 — and debugging gets noticeably easier. See
VLANs and tagged interfaces.
IPv6: stop counting
The v4 habits are actively harmful here. Never subnet smaller than a
/64; it breaks autoconfiguration and gains you nothing. Give every VLAN
its own /64, every customer or project a /56 or
/48, and do not think about it again.
Use the hex digits for meaning the same way:
2001:db8:0:20::/64 for VLAN 20. See
IPv6 on your server.
Write it down
A file in version control with the range, what it is for, which VLAN, and who owns it. For a handful of machines that is enough; past a few dozen, a proper IPAM tool such as NetBox or phpIPAM pays for itself — largely because it stops two people allocating the same subnet.
Keep it next to your machine inventory, as naming and labelling describes.
Public addresses
IPv4 is scarce, so plan it differently: public addresses only where something must be reachable from outside, everything else on private space behind them. A request for a larger block needs a sentence about what it is for, because RIPE expects addresses to be used — see additional addresses and routed subnets.
If you hold your own space, the plan is entirely yours and we simply route it — see bring your own IP space.
Avoid the ranges everyone else uses
192.168.0.0/24 and 192.168.1.0/24 are on every home router
in the world. Pick something in 10.x that nobody's VPN client will
collide with, and you will never have the conversation about why a customer cannot
reach your management network from their office.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base