In reply to a post by Pheasant:

Btw typically the gateway is .1 so the pool would start from .2 on most setups.

Heretic. All right thinking people and in my experience the vast majority of networks have the gateway set as the last IP address in the network range. So typically .254 unless you are subnetting on none byte boundaries

Yep that’s me. The….ahem…heretic. 😉😎

For VPN, the client IP pool does not need to lie within the subnet of another LAN, and it can avoid certain problems in the long run as well as being able to route and firewall less ambiguously.

As it stands you will be relying on other physical hosts in the 192.168.1.0/24 network thinking the VPN clients are present at the MAC layer (2) and the router typically needs to reply on behalf of the remote clients such as using proxy ARP.

If you know you don't need more than 120 hosts in the physical LAN one alternative is to run that as a /25, and you could reserve the first 20 addresses for static and still have a DHCP pool of about 100 items, .21 to .120

I'd typically then number the client VPN pool from 201 to 250 to exceed any initial requirement but leave room to grow downwards (towards the boundary at .128).

As to the original question as others have said I think it's just an arbitrary choice to set aside some IPs for static when you run the wizard, not a recommendation as such.
38 to 243 happens to be 80% of the range, starting 15% in.

Edited by prlzx (Sat 12-Mar-22 01:19:29)

You don't want overlapping pools.

It's nice to have some address space that isn't part of a DHCP pool, to give you somewhere to put things with static IPs.

Personally, I use 192.168.2.0/23 as a subnet on my home network, I.e. 192.168.2.0-192.168.3.255.

I then have my router on 192.168.2.1, all my static things on 2.x, and 3.x is my DHCP pool.

VPN clients are on their own subnet.

I've always used the first address. If you decide to expand the subnet range (for example from a /24 to a /23) then you don't need to change the gateway address.

This means that the devices in the subnet that you haven't managed to change yet and still have the /24 mask keep working in the interim.

Easy there Jon, you could be accused of networking heresy, despite the obvious logic.

I would say over the last 25 years the vast majority of subnets (be it /24, /23 or /22) in large organisations I have come across have used the last .254 on the range as the gateway, thats not to say using first .1 is not a good idea for the reason Jon said.

Edited by deleted (Sat 12-Mar-22 11:59:15)

Each to their own...I've been at it for 37 years.

In reply to a post by JonRennie:

Each to their own...

Indeed, just saying what I've seen.

In reply to a post by jchamier:

In reply to a post by Woolwich:

Why?!

The decision of the network designer. Some like to leave .1 to .20 for networking devices in a subnet, others like to leave .240 to .254. On enterprise networks I've seen the default gateway as .1 or .254 and in at least one case the network designer chose .100. I have no idea what they were thinking

It doesn't actually matter. But a practical reason could be the network started life as a smaller subnet - where .100 would be a perfectly "logical" decision and later got changed - so rather than change the gateway it was left.

It's not at all uncommon outside basic consumer networks for DHCP pools and Gateways etc to be in this scenario, and there's no "bad" way - I actually think .254 and .1 are poor choices on an IPv4 /24 for gateway for various reasons - not least because all it then takes is someone to connect something they shouldn't that also has a default IP on the same range on .1 or .254 and they will doubtless end up on that IP with the new device breaking connectivity for all - and sadly you can't always prevent someone doing something stupid.

Equally I would usually leave 'n' many IPs at the beginning of larger ranges for devices I explicitly want to be Statically assigned for whatever reason, so having a pool start further up makes sense. There is zero reason to care though as an end user with a client device - by design DHCP is supposed to mean you don't need to care