How To Configure Private IP address Ranges for Multiple Sub-Networks on RT6600ax Correctly?

[zombiephysicist]

Hi everyone:

I'm trying to set up customized Private IP address ranges with the RT6600ax and am having some problems. I'm using SRM 1.3.1-9346 and I think these questions probably apply to all other Synology routers as well. Below are my questions, a little background, and the ranges I'm trying to use. Thanks for any hlep!



Question 1: Are my Private IP address range Settings 1-3 below correct or wrong?

Question 2: If my Private IP address range Settings 1-3 below are wrong for being "too greedy" for wanting larger IP ranges, why can't we use the full allowed private IP range on our routers?

Question 3: If my Private IP address range Settings 1-3 below are wrong, what should they be assuming I want the biggest range that will work well?

Question 4: Why does Synology seem to introduce a minor limit their last octet range to 254 item range (192.168.1.1 - 192.168.1.254) instead of the full 256 item range (192.168.1.0 - 192.168.1.255)?

Question 5: Is the minor last octet range limit, noted above in Question 4, apply to other octets in the range? For example, would Synology limit the Class A private IP range to be 10.1.1.1 - 10.254.254.254 even though the actual range is 10.0.0.0 - 10.255.255.255? And if so, why, and how would we make entries for that range to work on the router?



A LITTLE BACKGROUND

I'm trying to set up different private IP ranges for my Synology router. When I use the default* Synology reduced class C private IP range, everything works great/perfectly! But I prefer the class A range that my old Apple Airport router used. In fact, I'd like to use the 3 seperate private ranges for each seperate sub-networks as follows:

Primary Network Class A private IP range: 10.0.0.0 - 10.255.255.255

Guest Network Class B private IP range: 172.16.0.0 - 172.31.255.255

IoT Network Class C private IP range: 192.168.0.0 - 192.168.255.255

*(note: Synology uses a reduced class C private IP range of 192.168.1.1 - 192.168.1.254 limiting their routers to only 253 additional devices)



Here are a few resources on the different class ranges that I read through:

5 Classes of IPv4 Addresses [Class A, B, C, D and E]

Private IP Address Ranges - IONOS Help

Understanding Private IP Ranges, Uses, Benefits, and Warnings | Okta Singapore

What Is a Private IP Address & What Are the Ranges?



The reason I would like the different ranges is it will make it very easy to spot a device and tell what network it is on just by its IP/range. Also, with so many IoT things that we are adding, we may likely need more than 253 devices on the network at some point.

The problem is, when I modify each of my 3 networks to the full Class A/B/C private IP ranges, things *seem* to work, but fringe items break. For example, when I just try to change my primary network to the full Class C private IP range things break/dont work when they worked fine with the default Synology reduced class C private IP range. Things like my coffee maker, and some websites just will not come up even though 99% of things do work (and this is without enableing the Guest or IoT, this is just for changing the primary network from the default Synology reduced class C private IP ranges to any of the other full Class A/B/C private IP ranges).

I'm assuming I'm entering something wrong in how I change the ranges, and will share that below, but one thing I wish Synology would do is give us a pop up to select our range without us having to hand tailor the range, introducting the potential to mess things up. Other router makers provide a pop-up menus that lets you select the Class A/B/C private IP range you like without having to hand tune all the details.



PRIVATE IP ADDRESS RANGES THAT I'M TRYING TO USE

Setting 0 (Global DNS): This setting for my global DNS:

Network Center>Internet>Manually Configure DNS Server>Preferred DNS Server: 9.9.9.9

Setting 1 (Class A private IP range) (Primary Network):

Network Center>Edit>General

Local IP: 10.0.0.1

Subnet mask: 8 (255.0.0.0)

Network Center>Ediot>IPv4 DHCP

Start IP address: 10.0.0.2

End IP address: 10.255.255.254

Gateway: 10.0.0.1

Primary DNS: 10.0.0.1

Setting 2 (Class B private IP range) (Guest Network):

Network Center>Edit>General

Local IP: 172.16.0.1

Subnet mask: 8 (255.0.0.0)

Network Center>Ediot>IPv4 DHCP

Start IP address: 172.16.0.2

End IP address: 172.31.255.254

Gateway: 172.16.0.1

Primary DNS: 172.16.0.1

Setting 3 (Class C private IP range) (IoT Network):

Network Center>Edit>General

Local IP: 192.168.0.1

Subnet mask: 24 (255.255.0.0)

Network Center>Ediot>IPv4 DHCP

Start IP address: 192.168.0.2

End IP address: 192.168.255.254

Gateway: 192.168.0.1

Primary DNS: 192.168.0.1

Setting 4 (Class C reduced private IP range) (these are default Synology reduced IP range settings):

Network Center>Edit>General

Local IP: 192.168.1.1

Subnet mask: 24 (255.255.255.0)

Network Center>Ediot>IPv4 DHCP

Start IP address: 192.168.1.2

End IP address: 192.168.1.254

Gateway: 192.168.1.1

Primary DNS: 192.168.1.1



So I think part of the problem is I'm trying to be too greedy and want use all of the class A/B/C private IP ranges that we are allowed to use. Synology seems to put 2 types of reductions on using private IP ranges as a default (minor and major):

Minor private IP range limitations on last octet

For example I show setting 4 above which is in the default Synology reduced class C private range, but Synology uses a reduced "minor last octet" range, where it artificially cuts off the beginning and end of an octet range. Synology does not seem to let you use 192.168.1.0 (zero) as a start to the range nor does it seem to let you use 192.168.1.255 (255) as the end of a range. All of Synology's range numbers for the last octet begin with a 1 and end with a 254 and in essense shorten the range of 256 down to 254. Why (Question 4)?

The router seems to not be able to use the full range without having some issues, but I ended the ranges for the last octet in Settings 1-3 above similarly to avoid, what I think, are artifical limits on the 'minor last octet' range required by Synology routers.

However, what I'm not sure of is this should this minor reduction be applied only to the last octet, or should it also be employed for other octets that are set to vary (Question 5)?

Major private IP range limitations

And perhaps more perplexing, I do not understand why Synology introduces a major reduction to its default class C private range to be 192.168.1.X when we (I think) are entitled to use the 192.168.X.X range. This means that by default, Synology routers are limited to about 253 devices because the address space will not go further by default.

Anyway, thank you so much for any help setting up the ranges properly!

 

[fredbert]

Primary Network Class A private IP range: 10.0.0.0 - 10.255.255.255

Guest Network Class B private IP range: 172.16.0.0 - 172.31.255.255

IoT Network Class C private IP range: 192.168.0.0 - 192.168.255.255

Primary Network is a Class A subnet using a 255.0.0.0 (or /8) mask.

Guest Network is 16 Class B subnets each can use a mask of 255.255.0.0 (or /16). Or the full range can use one mask of 255.240.0.0 (or /12).

IoT Network is a Class B subnet using a 255.255.0.0 (or /16) mask.


I’m not sure why you need 17.4 million IP addresses.

 

[zombiephysicist]

Primary Network is a Class A subnet using a 255.0.0.0 (or /8) mask.

Guest Network is 16 Class B subnets each can use a mask of 255.255.0.0 (or /16). Or the full range can use one mask of 255.240.0.0 (or /12).

IoT Network is a Class B subnet using a 255.255.0.0 (or /16) mask.


I’m not sure why you need 17.4 million IP addresses.

Thanks. When I try those, the router seems to have difficulty and not properly resolve some addresses. Not sure what I’m doing wrong but things work well only with the synology default range

 

[fredbert]

I’m trying to recall when I ran a couple of AirPort Extreme. I’m sure the DHCP service only supported up to a class C, I remember I held it back to 200 IPs so I had part of the LAN range for a VPN server. So I’m not sure if you had the full class A of 10… as the AirPort LAN, or not.*

Returning to SRM, using the full RFC 1918 reserved address ranges seems overkill even if you didn’t have any issues. Many ISPs will be using some of these within their infrastructure to route customers to the Internet. While that may not impact you using the full reserved space there may be some issues, it depends on whether those devices in the infrastructure are used as services by your router or devices.

For instance, I have my Virgin Media (UK) router in bridge/modem mode and my RT2600ac as my primary Internet router, with my assigned Internet IP address. To do this there is a small private subnet created between the VM device and the WAN interface of my router and this operates on 192.168.100.0/24. So I could not define a LAN segment as 192.168.0.0/16 because there’s an overlap and the router won’t know which side is truly 192.168.100.0/24... is it the private LAN side or the untrusted Internet side?

I would consider limiting your ranges to a see if a span of a few class C will work. A span of four class C in each LAN would allow for over one thousand devices in each. That would be a mask of 255.255.252.0 (or /22), though check which is the start point of the subnet as it doesn't necessarily start with the IP address you specify as the Local IP.

Also if you are going to run VPN Plus then it will require its own set of private subnets.


*Maybe it did. I spent more time with a hacked version of the older AirPort Utility v5 as it gave access to SNMP settings etc., these were omitted from the new utility that was harmonised with the iOS utility.

 

[fredbert]

I see that you have also got a more active thread at The Other Place on exactly this subject. So to avoid confusing you with two threads of discussion I'll leave you with Babylonia's support over there. Otherwise it may get messy.

For those interested in following up on this subject... How To Configure Private IP address Ranges for Multiple Sub-Networks on RT6600ax Correctly?

 

[zombiephysicist]

I’m trying to recall when I ran a couple of AirPort Extreme. I’m sure the DHCP service only supported up to a class C, I remember I held it back to 200 IPs so I had part of the LAN range for a VPN server. So I’m not sure if you had the full class A of 10… as the AirPort LAN, or not.*

Returning to SRM, using the full RFC 1918 reserved address ranges seems overkill even if you didn’t have any issues. Many ISPs will be using some of these within their infrastructure to route customers to the Internet. While that may not impact you using the full reserved space there may be some issues, it depends on whether those devices in the infrastructure are used as services by your router or devices.

For instance, I have my Virgin Media (UK) router in bridge/modem mode and my RT2600ac as my primary Internet router, with my assigned Internet IP address. To do this there is a small private subnet created between the VM device and the WAN interface of my router and this operates on 192.168.100.0/24. So I could not define a LAN segment as 192.168.0.0/16 because there’s an overlap and the router won’t know which side is truly 192.168.100.0/24... is it the private LAN side or the untrusted Internet side?

I would consider limiting your ranges to a see if a span of a few class C will work. A span of four class C in each LAN would allow for over one thousand devices in each. That would be a mask of 255.255.252.0 (or /22), though check which is the start point of the subnet as it doesn't necessarily start with the IP address you specify as the Local IP.

Also if you are going to run VPN Plus then it will require its own set of private subnets.


*Maybe it did. I spent more time with a hacked version of the older AirPort Utility v5 as it gave access to SNMP settings etc., these were omitted from the new utility that was harmonised with the iOS utility.

Thank you much appreciated.