How to Assign IP Addresses and Subnet Masks in a Basic Network

 The most expensive addressing mistake in small business networks is not a miscalculated subnet mask. It is choosing 192.168.1.0/24 — the same range shipped by default on nearly every home router in existence — and then discovering two years later that half the staff cannot connect to the office by VPN from home.

The reason is simple and entirely avoidable. When a remote worker's home network uses the same range as the office, their computer has no way to distinguish between the two. Traffic destined for an office server at 192.168.1.50 gets delivered to whatever sits at that address in their living room.

That single decision, made in five seconds during initial setup, is why choosing your IP address and subnet mask scheme deliberately matters more than the arithmetic most guides focus on.

What a Subnet Mask Actually Does

An IP address contains two pieces of information joined together: which network a device belongs to, and which device it is on that network. The subnet mask is what separates them.

Take 192.168.10.45 with a mask of 255.255.255.0. The mask says the first three portions identify the network and the last identifies the host. So this device is host 45 on network 192.168.10.0.

Every device uses this for one crucial decision, made on every single packet: is the destination on my own network, or somewhere else?

If the destination falls within the same network portion, the device sends the traffic directly. If it falls outside, the device sends it to its default gateway instead. That comparison is the entire purpose of the mask, and almost every addressing fault traces back to it producing an unexpected answer.

Reading CIDR Without the Arithmetic

Modern notation writes the mask as a slash followed by a number — 192.168.10.45/24 — where the number counts how many bits identify the network.

You do not need to calculate binary to work with this. Memorise a handful of common values and you will cover nearly everything you encounter:

• /24 — mask 255.255.255.0 — 256 addresses, 254 usable. The standard office subnet.
• /25 — 255.255.255.128 — 128 addresses, 126 usable.
• /26 — 255.255.255.192 — 64 addresses, 62 usable.
• /27 — 255.255.255.224 — 32 addresses, 30 usable.
• /28 — 255.255.255.240 — 16 addresses, 14 usable.
• /29 — 255.255.255.248 — 8 addresses, 6 usable.
• /30 — 255.255.255.252 — 4 addresses, 2 usable. Point-to-point links.
• /16 — 255.255.0.0 — 65,536 addresses. Far too large for a single segment.

The pattern: each step down doubles the size, and each step up halves it.

The Two Addresses You Cannot Use

In every subnet, two addresses are reserved and cannot be assigned to a device.

• The first address is the network address. In 192.168.10.0/24, that is 192.168.10.0. It identifies the network itself.
• The last address is the broadcast address. Here, 192.168.10.255. Traffic sent to it reaches every device on the segment.

This is why a /24 offers 254 usable addresses rather than 256. It is also why very small subnets become inefficient — a /30 provides four addresses and only two are usable, which is exactly right for a link between two routers and useless for anything else.

Choosing a Private Range

Three ranges are reserved for private use and will never appear on the public internet:

• 10.0.0.0/8 — 10.0.0.0 through 10.255.255.255. Enormous, and easily divided.
• 172.16.0.0/12 — 172.16.0.0 through 172.31.255.255. Frequently forgotten, which makes it useful.
• 192.168.0.0/16 — 192.168.0.0 through 192.168.255.255. The most heavily used, and therefore the most likely to collide.

The practical guidance, learned the hard way by everyone who has supported remote access:

• Avoid 192.168.0.0/24 and 192.168.1.0/24 entirely for any network people will connect to remotely. These are the factory defaults on consumer routers worldwide.
• Avoid 10.0.0.0/24 and 10.1.1.0/24 for the same reason — they are common defaults on some equipment.
• Pick something unusual. 10.37.14.0/24 has no obvious appeal, which is precisely its virtue. Nobody's home router uses it.
• Leave room to grow. If you take 10.37.0.0/16 as your organisational space, you have 256 possible /24 subnets within it and will never need to renumber.
• Plan for mergers and site-to-site links. Two companies with overlapping addressing cannot connect their networks without unpleasant workarounds.

One additional range worth recognising: 100.64.0.0/10, reserved for carrier-grade address translation. If your internet router shows an address in this range on its external interface, your provider is sharing public addresses between customers — which has implications for anything requiring inbound connections.

Sizing the Subnet

The instinct is to make subnets large enough to never run out. The better instinct is to size them for the segment they serve.

• A /24 suits most office segments, offering 254 addresses. Comfortable for up to roughly 100 devices once you account for phones and visitors.
• A /23 or larger for a single segment is usually a mistake. Large broadcast domains produce the problems VLANs exist to solve.
• Small segments deserve small subnets. A dozen servers do not need 254 addresses, and a /28 keeps the plan tidy.
• Point-to-point links take a /30, or a /31 on equipment that supports it.

More important than the size is consistency. A scheme where every site uses a /24 and the third octet identifies the site or VLAN is far easier to work with than one where subnet sizes were chosen individually to fit exact device counts.

The Default Gateway Rule

One rule, broken constantly: the default gateway must be an address inside the device's own subnet.

A device at 192.168.10.45/24 can use 192.168.10.1 as its gateway. It cannot use 192.168.20.1, because according to its own mask, that address is on a different network — and reaching a different network is precisely what it needs the gateway for.

The symptom when this is wrong is distinctive and worth recognising instantly: the device communicates perfectly with everything on its own segment and cannot reach anything beyond it. If you see that pattern, check the gateway before anything else.

The Mask Mismatch Failure

This one produces the strangest symptom in basic networking, and understanding it will save you an afternoon at some point.

Two devices on the same physical segment, with different masks:

• Device A: 192.168.10.45 with mask 255.255.255.0
• Device B: 192.168.10.200 with mask 255.255.255.128

Device A considers the network to run from .0 to .255, so it believes B is local and contacts it directly. Device B considers its network to run from .128 to .255, so it believes A is on a different network and sends replies to its gateway instead.

The result is asymmetric reachability. A can reach B; B's replies take a detour and may not arrive. Ping works in one direction and not the other, which looks impossible until you check the masks.

Whenever connectivity behaves differently depending on which end initiates it, compare the masks on both devices.

Public Addresses and What NAT Does

Private addresses cannot travel across the internet. Routers on the public internet are configured to discard them. So something has to translate.

That something is network address translation, performed by your internet router. When a device at 10.37.10.45 contacts a website, the router rewrites the source address to the single public address assigned by your provider, records the substitution in a table, and reverses it when the reply arrives.

Two consequences follow, and both matter when planning:

• Outbound works effortlessly. Hundreds of internal devices share one public address without any per-device configuration.
• Inbound does not work by default. An unsolicited connection arriving at your public address has no way of knowing which internal device it belongs to. Publishing a service requires an explicit port forwarding rule, or a VPN.

A related point that surprises people: NAT is not a firewall. It blocks unsolicited inbound traffic as a side effect of how it works, not as a security policy. It inspects nothing, logs little, and applies no rules to outbound traffic at all. Treating it as protection is a common and costly assumption in small networks.

If your provider gave you a block of public addresses rather than a single one, you have more options — including assigning public addresses directly to servers behind a firewall rather than translating them. Most small offices receive one address and translate everything.

A Worked Plan for a Forty-Person Office

Assume 40 staff, each with a computer and a phone, plus printers, access points, cameras, and a couple of servers.

1. Choose the organisational space: 10.37.0.0/16. Distinctive, spacious, unlikely to collide.
2. VLAN 10 — Users: 10.37.10.0/24. Gateway 10.37.10.1, dynamic pool 10.37.10.100 to .240.
3. VLAN 20 — Voice: 10.37.20.0/24. Phones, reservations for each.
4. VLAN 30 — Servers: 10.37.30.0/24. Static addresses from .10 upward.
5. VLAN 40 — Printers and devices: 10.37.40.0/24. All reservations.
6. VLAN 50 — Guest: 10.37.50.0/24. Dynamic only, short leases, no internal routing.
7. VLAN 60 — Cameras: 10.37.60.0/24. Reservations, no internet access.
8. VLAN 99 — Management: 10.37.99.0/24. Switches, firewall, access points. Static, tightly restricted.

The pattern makes the scheme readable at a glance: the third octet is the VLAN number. Anyone seeing 10.37.60.14 knows immediately it is a camera.

Within each subnet, reserve the low addresses for infrastructure, the middle range for DHCP reservations, and the upper range for the dynamic pool — and configure exclusions in DHCP covering everything outside the pool.

Document It Before You Need It

An addressing plan that exists only in a working network is not a plan. It is an archaeological site.

Record, at minimum: each subnet and its purpose, the gateway address, the DHCP pool boundaries, every statically assigned address and what it belongs to, and the VLAN each subnet maps to.

Keep it somewhere accessible when the network is down, which rules out a file server on that network.

That documentation is what makes the difference between a network someone else can take over and one that has to be reverse-engineered — and it is the part of assigning an IP address and subnet mask that nobody enjoys and everybody eventually wishes had been done properly.