Public service announcement ...

It's scary how quickly you can use up all your address leases. Most routers only hand out Class C private addresses in which you have one byte to record the unique part of the IP address. This means you can have a maximum of 252 devices: you need one address (often 192.168.x.1 or 192.168.x.254) to address the router itself. The 0 and 255 addresses are "spoken for" as part of the addressing scheme - I think 255 is for broadcasts and I forget what 0 is used for.

I wonder if any routers can be set to Class B addresses in which two bytes (a total of 64K, minus a few for broadcasts) are used to identify the devices on the network.

I've just checked my router and I've got a scope of 192.168.1.2-250, with the router on .1

I have configured the DHCP on my router to reserve addresses for my PCs, Raspberry Pis and phones/tablets so each of those always gets the same address. Internet-of-Things devices such as Kasa smart plugs, Hive and Philips Hue hubs and so on get random addresses. Oh, and my printer has a reserved address as well, because computers need to address it by IP rather than using a name-to-IP translation service such as NetBIOS.

The bigger problem that we've had is not running out of IP addresses but running out of Philips Hue bulbs that can be addressed by one Hue hub. Our house has a lot of GU10 bulbs in various rooms (it was like that when we bought it), so that's a lot of bulbs to be addressed. We were starting to get slow or unpredictable effects once we got close to the limit of 64 bulbs. Then Philips enhanced their app so it would access more than one Hue hub, and we allocated different rooms to two different hubs. It was slightly tedious to switch the app between hubs depending on which rooms/bulbs we wanted to control, and there was a really annoying restriction that only one of the hubs could be accessed from outside our LAN (eg if we were away on holiday and wanted to turn lights on or off remotely).

But in the last few weeks the app has been upgraded again (at last!) to allow the bulbs on several hubs to be merged into one "virtual hub" and the whole of this virtual hub can be controlled from outside the LAN. Job done - at last! It was getting to the stage where I imagine it was impacting sales of Hue bulbs because who would buy more than 64 if only

one thing that can be done is install a Smoothwall or IPCop with 4 NICs. One is to connect to Router (WAN), one for a DMZ, one for a wired LAN and one for a Wireless WiFi LAN.... so thats two sets of 192.168.X.1-254 and 192.168.Y.(1-254) IP addresses.

All my NASes, PiHole, Wireguard, desktop PCs, TV sets, Satellite recievers, CCTV and intruder/fire alarm are on WIRED LAN, all the mobile phones, tablets and laptops and the Roku sticks are on the WIRELESS LAN.

Stephen.

You don't need multiple NICs, a router that supports VLANs and a 'smart' switch with VLAN support (TP-Link, £25) is enough. Flashing your router with OpenWRT or DD-WRT is a way to get VLAN support.

Theo

Surely, you can't run a VLAN without VLAN switches. I don't think any of my switches support VLAN tags.

What is the problem with having multiple subnets: 192.168.0.x,

I assumed I could set my LAN subnet up to 16 bits, instead of 8. Or alternatively, have multiple 8 bit subnets, with appropriate routing rules between them, if any were required.

I've never tried because I only have about 10 smart plugs. ARP is only showing about 25 current devices.

My Draytek allow up to 1021 addrs (so a supernet of 4x class C) on LANs

I do currently run a class C network, but as the addresses are managed by my home server and not my router, I could easily upgrade to class B.

I had to stop using my Draytek, as when we switched ISPs, their router could not be switched to modem mode and I did not want the problems of double NAT.

I am pretty sure my router will allow me to use any damned IP addresses I want on my own LAN.

And subnet masks.

On a private LAN the only reason to use the 192.168.x.x is because its guaranteed not to clash with anything on the real internet

You could pick a class A network like 10.x.x.x. Or a class B between 172.16.x.x and 172.31.x.x Or use the netmask 255.255.255.1 and use 192.168.0 and 192.168.1

Or have two LANS served by the router and route between them.

Although that is a lot more complicated

Indeed. Devices - despite Occam's Razor - do seem to multiply beyond necessity.

Mine will allow anything I damn well choose. Class C with a netmask spanning 512 addresses would be my easiest choice, or set up a class B

I am surprised. Mine worked perfectly

He means he can't connect his Draytech direct to the ISP connection.

He needs some kind of ONT/Modem/Handshaking protocol to manage the connection to the ISP. It is this ISP device that insists on introducing a NAT layer. The Draytech has to be connected behind the ISP device NAT. If the Draytech isn't controlling a NAT layer, it doesn't serve much purpose.

VirginMedia used to work like that for a bit, when they introduced the Superhub, but they quickly introduced a firmware update to allow it to run in modem only mode.

I'd be interested to know what ISP has this restriction.

Temperature sensors x 7 Curtain motors x 4 Lights x 8

Switched plugs x 5 Thermostat My PCs and server x 5 Phones x 4 iPads x 2 TV TiVo BluRay Mesh Network x 3 SmartMeter Robovac Google Nest x 3 Booster routers x 2

to be getting on with. And some of those need 2 ...

You can pass VLAN tagged frames through a non-VLAN switch, but if you want to split off the VLANs to different switch ports you need a switch that knows about VLANs. One of these will do it:

You can't typically run multiple subnets on the same interface. If the router allows you can have one bigger subnet though, ie 192.168.0.0/23.

(technically you can, but it's messy)

If your router allows you to set up multiple subnets and map them to its different ports then that might work. Most routers have a 5-port VLAN-tagged switch internally with the LAN and WAN ports being the 5 ports on the switch (no hardware difference between LAN and WAN side). Usually VLANs are used to link LAN1-4 as one network and WAN as another network, but there's no reason you can't assign LAN1 to a VLAN of your creation and LAN2 to a different VLAN, etc.

That assumes your router allows that - OpenWRT does, I can't speak for other routers.

Another reason you might do it is to have different firewall rules - eg I have a VLAN with no internet connectivity so printers can't phone home and download firmware updates that block using aftermarket cartridges.

Theo

What sort of problems can be caused by double NAT? When we first got Linksys Velop mesh nodes, I set them up the way that Linksys wanted, using one of the Velops as the DHCP server for the home network, connected to my ISP's router by Ethernet. The network had 10.x.y.z addresses and the ISP's router used 192.168.1.x addresses (though only one was used, that of the Velop primary node). Thus there were two levels of network address translation: 10.x.y.z to 192.168.1.x and

This worked fine. I even managed to set up port forwarding to allow WAN access (eg mobile phone away from home) access to security cameras on the 10.x.y.z network.

I only changed to the present setup (Velops in dumb bridge mode, router acting as DHCP server for network) when I began having intermittent problems with some devices (not always the same ones, though they were all Android or iPad) failing to browse to rented webspace. And that continued after I'd changed to the new topology (I couldn't be arsed to change back again) and was only fixed when the webspace company (GoDaddy) upgraded their server. They weren't able to identify the problem before that, even though I sent them Wireshark traces showing a computer doing an HTTP request and getting no response, with TCP packets being re-sent at ever-doubling intervals of time with no ack from the webspace server. But as soon as they emailed me to say that they were upgrading their server, the problem went away, so it looks as if that was the fix.

The problem is that the ISP's router also provides the "landline" phone and they won't release the details to allow me to connect it via a separate box. Hence I am forced to use their router and, as it cannot be switched to a modem only mode (as I did with our previous ISP), I'd end up with the Draytek double-NATted.

Time for a different ISP then.

"Round our way" it's become an interesting tussle between BT, Sky, Virgin and BRSK.

I run double IPv4 NAT, putting my own router behind my ISP's router. That's primarily because the ISP router's Broadcom modem gets better VDSL speed and more stability than my router's Lantiq modem, despite trying several modem firmware versions. It also means my internet-facing router gets security updates provided by my ISP. Between the two routers is a kind of 'DMZ' that I can put internet-facing machines without letting them see my internal network, allowing access from the internet via port forwarding settings on the ISP router. Changing ISP is just a case of switching the outer router and everything else stays the same.

Double NAT has turned out not to be a problem - it can cause troubles for some online gaming (I don't) and for SIP VOIP (which for me works fine using STUN).

Slightly more awkward is propagating a suitable IPv6 range to the internal network - depends on how the ISP router is set up.

Theo

My draytek is behind such a fibre ONT. As supplied by Open Retch It imposes nothing on me at all.

It sounds utterly weird.

My router does PPPoE with its *public* interface set to whatever the ISP demands (sets up with DHCP)

The ethernet to the ONT is not even IP- addressed . It is a pure bridge.

The routers *private* IP network is a free choice.

God help you if the internet goes down, Do you REALLY need IP addressable curtains? And lights that you can turn on from the other side of the world? And WTF is a booster router.