Which address space would you use inside a company, and which ranges do you avoid?
Show the answer
Say this first
RFC 1918 space: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. For any real company I start from 10.0.0.0/8 because it has room for a clean hierarchy. I avoid ranges that collide with common defaults: 192.168.0.0/24 and 192.168.1.0/24 (home routers), 10.0.0.0/24, 172.17.0.0/16 (Docker's default bridge) and 172.31.0.0/16 (the AWS default VPC), because VPN users and cloud links will overlap them sooner or later.
Go deeper
Rules
- Never use public space you do not own "because it was free". Those destinations become unreachable.
- 100.64.0.0/10 (RFC 6598) is shared address space for carrier-grade NAT, meant for providers, not a spare private range for the LAN.
- Allocate hierarchically so every site and function summarizes. Record every allocation in an IPAM tool from day one.
- Plan for mergers: a random choice inside 10.0.0.0/8 is more likely to overlap an acquired company's network than a plan that skips the obvious ranges.
IPv6
Get a global prefix, provider-independent from the RIR or from the ISP. Give each site a /48 (or at least a /56) and each VLAN a /64, which SLAAC needs. Unique local addresses (fd00::/8) exist for internal-only use, but most designs use global addresses with firewalls instead of IPv6 NAT.
They will ask next
Why is 192.168.1.0/24 a poor choice for an office LAN?
Many home routers use it. A remote worker on that home LAN connects to the VPN and the office subnet looks directly connected to their laptop, so traffic for office hosts goes to the local network instead of the tunnel. It is a support ticket waiting to happen.
You acquire a company that uses the same 10.1.0.0/16 as you. What do you do?
Short term, NAT between the overlapping networks (translating both source and destination where needed) and DNS entries that point to the translated addresses, so the companies can talk. Long term, re-address one side into a free block in the plan. NAT between overlaps works but is hard to troubleshoot and breaks some applications.
Traps
- Saying 172.16.0.0/16 is the private range. The RFC 1918 block is 172.16.0.0/12, from 172.16 to 172.31.