While an address plan is still on paper, moving a network takes a minute. Once the scripts are on the hardware, a different range means rolling out every device again, checking every fixed address, and going through every firewall rule. So make this plan before you fill in the first field in the configurator.
The private ranges
A network behind NAT uses addresses from one of these three ranges. They are not in use anywhere on the internet, so they can never clash with a service you want to reach.
| Range | From and to | Number of /24 networks |
|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 to 10.255.255.255 | 65,536 |
| 172.16.0.0/12 | 172.16.0.0 to 172.31.255.255 | 4,096 |
| 192.168.0.0/16 | 192.168.0.0 to 192.168.255.255 | 256 |
10.0.0.0/8 is the roomiest and the pleasantest to plan with: the second octet is free for locations and the third for VLANs. 192.168.0.0/16 is enough for one site with a handful of VLANs, but it is also the range everybody else is in, and you notice that the moment a VPN or a second office appears.
Watch the middle range: private runs from 172.16 through 172.31, and no further. Something like 172.168.30.0/24 looks like it belongs, but it is public space owned by somebody else. Your network works fine until a customer needs a service in that block: it stays unreachable, because your own router sends that traffic inwards. The configurator accepts any valid address and does not check this, so this one is yours to catch.
Why 192.168.1.0/24 and 192.168.88.0/24 disappoint
They work, for exactly one network. 192.168.1.0/24 is in almost every consumer router, and 192.168.88.0/24 is the RouterOS factory default. It turns into a problem as soon as a second network is involved.
- A VPN from home or a hotel. If the office is on 192.168.1.0/24 and the home network is too, the laptop has two routes to the same network. It takes the local one, and the tunnel gets you nothing. No setting at the office end fixes that.
- A second location. Two sites on the same subnets cannot be joined by a routed tunnel: both ends claim the same networks.
- Taking over an existing network. Put a new MikroTik next to the router that is already there and its 192.168.88.1 management address collides with what is running.
In a site with several devices the tool sees part of this coming. Two locations on the network board that end up on the same subnets raise a warning, with the reason attached: otherwise they cannot talk over a VPN later. A routed tunnel between two locations with overlapping networks is reported as routes that clash. What the tool does not do is pick your defaults for you: a new site starts at 192.168.88.1/24 and the first VLAN at 192.168.10.1/24. Overwrite those in the shared settings straight away, before you click on.
How big a subnet should be
- /24 gives 254 usable addresses. That is the right size for nearly every office or home network, and it reads well: the third octet is the network, the fourth is the device.
- /23 or /22 for a guest network in a place where hundreds of phones pass through. A full guest network does not produce an error message, it only stops handing out addresses.
- /30 has two usable addresses. That is enough for a point to point link between two routers and for nothing else. A management network with a switch, two access points and your laptop does not fit in it.
- Anything smaller than a /24 for an ordinary network rarely pays off. You save addresses you were never short of, and pay with arithmetic at every change.
Leaving room to grow
Leave gaps. Two rules do most of the work:
- The third octet is the VLAN number. VLAN 20 is 192.168.20.0/24 or 10.1.20.0/24. You can then read off which network an address belongs to. The tool follows this by itself for new VLAN rows, see planning your VLANs.
- The second octet is the location. Head office 10.1, warehouse 10.2, the director's home office 10.3. Every next building then fits without thinking.
On the network board a location can be given its own range, entered as the first two numbers, for example 10.2. The third and fourth octet keep coming from your VLAN plan, so VLAN 20 at 192.168.20.1/24 becomes 10.2.20.1/24 there. One plan serves every location without overlap. If two locations use the same range, that is an error in the checks.
Fixed addresses
Agree up front where the fixed addresses live. For example: .1 the router, .2 to .20 network equipment, .21 to .50 servers and printers, the rest DHCP. Keep those fixed addresses outside the DHCP range, or the router can hand out the same address again. If you draw servers or virtual machines on the network board, the tool reports an address that falls inside the DHCP range, sits outside the network, or is the network, broadcast or router address.
Write it down
A plan that only lives in the tool only lives on that computer. Save the site as a file, and print the handover sheet: it carries the VLAN table with subnet, router address and DHCP per network, so the next person does not have to guess. See LAN and DHCP for what the tool generates from these addresses.