Subnetting

What is subnetting?

Subnetting is the practice of dividing a single IP network into several smaller, logically separate networks (subnets) by using a subnet mask or CIDR prefix to define which part of an IP address identifies the network and which part identifies the device. Devices in the same subnet talk to each other directly; traffic to another subnet has to pass through a router or firewall. In OT environments, subnetting is therefore the technical foundation of network segmentation: without separate subnets there is nothing between production cells that you can filter.

🧠 How is an IPv4 address structured?

An IPv4 address consists of 32 bits, written as four octets from 0 to 255, for example 192.168.10.25. Those 32 bits split into two parts:

• Network portion — identifies the subnet; every device in the same subnet shares the same network portion
• Host portion — identifies the individual device within that subnet, such as a PLC, HMI or industrial switch

The boundary between the two is set by the subnet mask: a 32-bit value with contiguous ones for the network portion and zeros for the host portion. 255.255.255.0 therefore means the first 24 bits are network and the last 8 bits are host. CIDR notation (Classless Inter-Domain Routing) expresses the same thing more compactly as a prefix length: 192.168.10.0/24.

Subnetting was standardised in 1985 in RFC 950. CIDR followed in 1993 (RFC 1519, later replaced by RFC 4632), abandoning the old fixed class A, B and C boundaries and allowing prefixes of any length.

🔧 Which subnet masks are used most often?

The number of addresses in a subnet is 2 to the power of the number of host bits. Two addresses are always reserved: the network address (all host bits 0) and the broadcast address (all host bits 1). What remains are the usable host addresses.

A /31 (RFC 3021) is intended only for point-to-point links and has no network or broadcast address. A /32 denotes a single address, for instance in a firewall rule.

🌐 Which private address ranges should you use in an OT network?

Internal networks use the private ranges defined in RFC 1918 (February 1996). These addresses are not routed on the internet and any organisation may use them freely.

Precisely because everyone uses the same ranges, they clash easily: many machine builders ship their equipment preconfigured in 192.168.0.0/24 or 192.168.1.0/24.

📐 How do you split a /24 into four subnets? A worked example

Suppose you have been allocated 192.168.10.0/24 for a small plant and want four separate subnets for the levels of the Purdue Model. This is how you work it out step by step:

1. Decide how many subnets you need — four subnets require 2 extra network bits, because 2² = 4.
2. Calculate the new prefix — /24 + 2 = /26, subnet mask 255.255.255.192.
3. Determine the block size — 32 − 26 = 6 host bits, so 2⁶ = 64 addresses per subnet.
4. Count in steps of 64 — the subnets start at .0, .64, .128 and .192.
5. Assign the network, gateway and broadcast address for each subnet.

Each subnet has 62 usable addresses, one of which goes to the default gateway: the router or firewall interface through which traffic leaves the subnet. A common convention is to place the gateway consistently on the first (or the last) usable address of every subnet, so engineers can find it without consulting the documentation.

🔗 How do subnets and VLANs relate?

A subnet is a logical division at layer 3 (IP); a VLAN is a separation at layer 2 (Ethernet). Standard practice is one VLAN per subnet: VLAN 110 carries 192.168.10.0/26, for example, and VLAN 120 carries 192.168.10.64/26. Two subnets sharing one VLAN still share their broadcasts and therefore offer little real separation. Conversely, a VLAN without its own subnet has no routing boundary at which a firewall can enforce rules.

🏭 How do you design subnets for an OT network?

• One subnet per zone or cell — this maps onto the zones of the zones and conduits model in IEC 62443; the conduit between two zones then runs through the router or firewall that connects their subnets.
• Firewall rules between subnets — allow only the traffic that is genuinely needed, such as OPC UA from level 3 to level 2, and block everything else.
• Avoid flat /16 networks — a single 172.16.0.0/16 with 65,534 hosts is one broadcast domain and one zone; ransomware or a broadcast storm then reaches the entire plant.
• Static addresses and an IP plan — controllers get fixed addresses; DHCP in OT is suitable at most for laptops and clients. Record every subnet, VLAN ID, gateway and address, ideally linked to your asset inventory.
• Reserve room for growth — size each subnet for expected expansion, not for today’s device count.
• Resolve overlapping subnets with NAT — ten identical machines that each use 192.168.0.0/24 cannot simply be routed. A 1:1 NAT router or firewall per machine translates the internal machine network to a unique external subnet, so the machine builder does not have to change the internal addressing.

🧪 What commonly goes wrong with subnetting?

• Wrong subnet mask on a PLC — if the mask is /16 instead of /24, the PLC assumes addresses in other subnets are local and never sends that traffic to the gateway.
• Duplicate IP address — two devices with the same address cause intermittent communication faults that are hard to trace.
• Missing or incorrect gateway — the device works fine locally but cannot be reached from SCADA or the historian.
• Overlap with the IT network — if OT picks the same range as the office network or VPN, routing conflicts appear as soon as the two are connected.

Useful tools include a subnet calculator (such as ipcalc), Wireshark to inspect ARP and broadcast traffic, IPAM software to maintain the IP plan and passive asset discovery to find duplicate or unknown addresses.

🆕 How does subnetting work in IPv6?

IPv6 uses 128-bit addresses with the same prefix notation. A LAN subnet there is almost always a /64: under RFC 4291 the last 64 bits form the interface identifier. A site with a /48 prefix can therefore create 65,536 subnets of /64 each. IPv6 remains uncommon in OT; most controllers and industrial Ethernet protocols are still deployed on IPv4.

❓ Frequently asked questions

What is the difference between a subnet mask and a CIDR prefix?

A subnet mask and a CIDR prefix express exactly the same thing: how many bits of an IP address make up the network portion. The subnet mask 255.255.255.0 is equivalent to prefix /24. CIDR notation is shorter and is what routers, firewalls and documentation use most.

How many hosts fit in a /24 subnet?

A /24 subnet contains 256 addresses, of which 254 are usable for hosts. The first address is the network address and the last is the broadcast address. One of the 254 host addresses usually goes to the gateway.

Why is subnetting important for OT security?

Subnetting makes it possible to divide an OT network into zones with a router or firewall between them. Only at that boundary can you filter, log and restrict traffic. Without subnetting the network is flat and an infection can spread unhindered.

Should every VLAN have its own subnet?

Yes, in practice you map each VLAN to exactly one subnet. That way the layer 2 separation of the VLAN coincides with the layer 3 boundary where a firewall enforces its rules. Several subnets in one VLAN give a false sense of security, because broadcasts and ARP traffic remain shared.

How do I deal with overlapping IP addresses from machine builders?

Overlapping IP addresses from machine builders are usually resolved with 1:1 NAT on a router or firewall per machine. The internal machine network stays unchanged, while each machine presents a unique subnet to the outside. An alternative is to specify an address range per machine in your purchasing requirements.

Which subnet size should I choose for a production cell?

For a production cell a /26 (62 hosts) or /27 (30 hosts) is usually sufficient. Size the subnet for the expected number of devices including future expansion, and keep a block free per area in your IP plan. A subnet that is too large makes the broadcast domain needlessly big, while one that is too small forces renumbering later.

📌 In summary

Subnetting divides an IP network into smaller subnets using a subnet mask or CIDR prefix, and forms the foundation for zones, VLANs and firewall rules in an OT network. A well-considered IP plan with one subnet per zone, static addresses and NAT for overlapping machine networks prevents faults and makes segmentation in line with IEC 62443 possible.