What a /24 subnet actually means (and how to plan yours)

Every example network in the books is written the same way: 192.168.10.0/24 for the house LAN, 10.30.0.0/24 for servers, 192.168.30.0/24 for IoT. That little /24 shows up on firewall interfaces, container network settings and VPN configs, and once you can read it, a lot of homelab networking stops being magic.

What the /24 tells you

An address like 192.168.30.57/24 has two parts. With a /24, the first three numbers (192.168.30) name the network, and the last number (.57) names the device on that network. Every device whose address starts with 192.168.30 is on the same subnet. A device at 192.168.10.57 is on a different one, even though it ends in the same number.

That split decides who can talk to whom:

• Devices on the same subnet reach each other directly. On a flat home network, every device can see every other device's open ports.
• Devices on different subnets need something to route between them, which is exactly where a firewall can sit and decide what is allowed.
• Some traffic never crosses at all. A router does not forward multicast between subnets, which is why a phone on one network asking "is there a TV here?" never reaches a TV on another, and the cast button stays grey. Nothing is blocked; the question just never arrives.

The same notation appears on the gateway itself. When the firewall's interface is set to 192.168.30.1/24, that one line says both "my address is .1" and "everything in 192.168.30.x is on this interface".

The trap: one /24 for everything

The usual home network has one subnet behind the router. Your laptop, the smart plug, the TV, a visiting friend's phone and the Proxmox host all get an address from the same pool. The only firewall rule that matters is the one between the house and the internet: the front door is guarded while every interior door stands open.

That holds until something on the inside goes bad. Cheap smart-home gear often runs old software that rarely sees an update, a phone picks up a malicious app, a guest's laptop arrives already infected. On a flat /24, any of them can scan the subnet and find the Proxmox web interface, the NAS share or the printer with its default password.

The fix: one /24 per zone

Lock Down Your Home Network groups devices into five zones, each with its own VLAN and its own /24:

Two conventions make this plan easy to live with:

• The third number matches the VLAN ID. When you see 192.168.30.57 in a log, you know it is an IoT device without looking anything up.
• The firewall is always .1. Every zone's gateway is the same last number, so there is nothing to remember per network.

In OPNsense, each VLAN becomes its own interface with a static address and the right prefix, for example 192.168.30.1/24. A new interface allows nothing by default: OPNsense blocks traffic arriving on an interface with no pass rules, so each new network stays dark until you write its rules. That is the right starting point.

Resist making more zones on day one. Every zone is another rule set to write, test and keep tidy; add a sixth only when you can name the rule that would be different for it.

Smaller version: a servers /24 behind OPNsense

If you are not ready for VLANs yet, Homelab the Right Way starts with a single separate network for your servers, 10.30.0.0/24, on a Linux bridge on the Proxmox host. Add the bridge in /etc/network/interfaces and apply it with ifreload -a:

auto vmbr1
iface vmbr1 inet manual
    bridge-ports none
    bridge-stp off
    bridge-fd 0

Give the OPNsense VM a NIC on vmbr1 and assign it as SERVERS with the static address 10.30.0.1/24. Static IPs are recommended for servers, so they have predictable addresses. Then move one container at a time, giving it an address inside the new /24 and OPNsense as its gateway:

pct set 120 --net0 name=eth0,bridge=vmbr1,ip=10.30.0.20/24,gw=10.30.0.1
pct exec 120 -- sh -c 'ip route; ping -c2 10.30.0.1'

Notice that ip=10.30.0.20/24 carries the /24 too: it tells the container which addresses are local and which must go through the gateway.

Before you begin, write a table of old IP to new IP, and either keep the old address as a secondary for a while or update DNS and reverse proxy entries in the same sitting.

Don't forget the route back

A new subnet is invisible to the rest of the house until something knows how to reach it. Clients on the house LAN need a route to 10.30.0.0/24. The clean way is a static route on the house router: 10.30.0.0/24 via 192.168.10.2, the OPNsense WAN address. Then allow the house LAN in on OPNsense's WAN interface for the specific ports you need, and disable Block private networks on WAN, since in this layout your "WAN" is itself a private network.

Keep your management path where it is: leave the Proxmox web UI and SSH reachable on the house LAN, so a firewall mistake never locks you out of the host.

Checklist: planning your /24s

• You can read any address in your logs and say which network it belongs to
• Every device is listed with the zone it belongs in
• One VLAN ID and one /24 per zone, with the third number matching the VLAN ID
• The firewall is .1 on every network, set with the right prefix (e.g. 192.168.30.1/24)
• Servers use static addresses; DHCP ranges are set only where a zone needs them
• An old IP to new IP table is written before anything moves
• The house router has a static route to the servers subnet
• The Proxmox web UI and SSH stay reachable on the house LAN

Found this useful? Subscribe on YouTube for the daily video, or follow the RSS feed.