Address Allocation Rules
Default role bands, stable physical-host octets, host-interface addressing policy, and documented exceptions for pinned services and VIPs.
Role bands make unassigned address space predictable, while a stable last octet identifies each physical host across the infrastructure VLANs it terminates. Exact entries in the IP Tables remain authoritative when a pinned service or VIP intentionally uses another band.
Default Bands
| Last-octet range | Default use |
|---|---|
.1 | OPNsense gateway on a routed subnet |
.2-.9 | Network infrastructure such as switches and APs |
.10-.39 | Physical host interfaces using the host-octet convention |
.40-.49 | Infrastructure service VMs and appliances |
.50-.199 | DHCP pools or additional static services |
.200-.254 | VIPs, MetalLB pools, and load-balancer addresses |
Bands Are Allocation Guardrails
The bands guide new assignments; they do not replace the exact address registry. Pinned DNS, Proxmox Backup Server, Kubernetes API, and ingress addresses already occupy documented exceptions. Check the IP tables before assigning an address.
Networks Without a Gateway
The .1 convention applies only where a routed subnet exists.
| VLAN | Site scope | Addressing rule |
|---|---|---|
| 25 | Both sites | Corosync peers receive direct addresses with no gateway |
| 60 | Both sites | Storage consumers receive direct addresses with no gateway |
| 65 | Site B | Ceph cluster peers receive direct addresses with no gateway |
| 65 | Site A | Prefix reserved; VLAN not carried |
| 999 | Site A | No IP subnet at all |
Do Not Add a Convenience Gateway
VLANs 25 and 60 remain local-only. VLAN 65 remains isolated at Site B and reserved at Site A. Routing VLAN 60 to VLAN 65 or adding a default gateway is an architecture change, not a routine firewall adjustment.
Physical Host Octets
A physical host reuses the same last octet on each infrastructure VLAN where it
holds an address. For example, sa-stor-01 uses .20 on Proxmox management,
Corosync, storage, and backup networks.
| Host | Site | Stable octet |
|---|---|---|
sa-edge-01 | Site A | 10 |
sa-cmp-01 | Site A | 11 |
sa-cmp-02 | Site A | 12 |
sa-stor-01 | Site A | 20 |
sb-edge-01 | Site B | 10 |
sb-cmp-01 | Site B | 20 |
sb-cmp-02 | Site B | 21 |
sb-cmp-03 | Site B | 30 |
sb-cmp-04 | Site B | 31 |
sb-cmp-05 | Site B | 32 |
Host Interface Policy
Proxmox receives an L3 address only on infrastructure networks used by the host itself. Workload and client VLANs may cross a VLAN-aware bridge, but the bridge does not receive a host address on those segments.
| Network group | Proxmox host behavior |
|---|---|
| VLAN 10, Network Mgmt / IPMI | Switches, APs, and BMCs receive addresses; the Proxmox host OS does not |
| VLAN 20, Proxmox Management | Every Proxmox node receives its primary management address |
| VLAN 25, Corosync heartbeat | Every cluster node receives its stable host octet with no gateway |
| VLAN 60, Storage / Ceph public | Approved storage and compute nodes receive direct addresses; edge nodes are excluded |
| VLAN 65, Ceph cluster | Site B Ceph nodes only; Site A does not carry the VLAN |
| VLAN 90, Backup / Replication | Approved storage and compute nodes receive addresses; edge nodes are excluded |
| VLANs 30, 40, 50, 70, 80, 100, 110, 120 | Bridged to workloads or clients with no Proxmox host address |
/22 Allocation Exceptions
VLANs 40 and 100 span four /24 boundaries, so their exact allocations matter
more than the shorthand band table.
| Network | Exact rule |
|---|---|
| Kubernetes Nodes, VLAN 40 | Physical-node addresses use the first /24 and the stable host octet, such as 10.10.40.11 |
| Lab / Trusted Client, VLAN 100 at Site A | DHCP spans 10.10.100.50-10.10.103.199 |
Do not infer that an unused-looking address in a /22 is available. Confirm it
against the IP Tables and VLANs and Routing.
Use DHCP and IPAM Operations for the
allocation, reservation, and reconciliation workflow.
Address Space and Lifecycle
Site summary blocks, bootstrap ranges, final-address transitions, and reserved network space for Site A and Site B.
DHCP and IPAM Operations
Assignment ownership, Site A DHCP scopes, reservation lifecycle, address-allocation workflow, conflict prevention, and reconciliation evidence.