IP Addressing, Subnets and VLANs
Addresses and masks, subnet math, gateways, DHCP and BOOTP, ports, VLANs and a machine-network design example.
On this page
- IP addresses and subnet masks
- Subnet arithmetic
- Gateways and routing
- Private addresses and NAT
- Assigning addresses: static, DHCP, BOOTP
- Ports and the services behind them
- VLANs
- A machine-network design
- Command-line tools for checking
- Setting the address on each platform
- An address plan template
- Common mistakes
- FAQ
IP addresses and subnet masks
Every device on an IP network has an IP address, a 32-bit number written as four decimal numbers (192.168.10.10), and a subnet mask that splits the address into a network part (which must be the same for devices that talk directly) and a device part (unique within the network). A mask of 255.255.255.0 means the first 24 bits are the network: all devices from 192.168.10.1 to 192.168.10.254 are on the same subnet. The same mask is written /24, the number of network bits.
| Item | Example | What it is |
|---|---|---|
| IP address | 192.168.10.10 | Unique on the network |
| Subnet mask | 255.255.255.0 (/24) | Says which bits are network and which are device |
| Network address | 192.168.10.0 | The address with all device bits 0: names the subnet; not assignable |
| Broadcast address | 192.168.10.255 | The address with all device bits 1: every device on the subnet; not assignable |
| Default gateway | 192.168.10.1 | The router for traffic to other subnets; leave blank on an isolated network |
| MAC address | 00:1B:1B:12:34:56 | The fixed hardware address; used on the local segment and to find a device with no IP |
Subnet arithmetic
| Prefix | Mask | Addresses | Usable devices | Note |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16 777 216 | 16 777 214 | |
| /16 | 255.255.0.0 | 65 536 | 65 534 | |
| /20 | 255.255.240.0 | 4 096 | 4 094 | |
| /22 | 255.255.252.0 | 1 024 | 1 022 | |
| /23 | 255.255.254.0 | 512 | 510 | |
| /24 | 255.255.255.0 | 256 | 254 | one “class C” network |
| /25 | 255.255.255.128 | 128 | 126 | |
| /26 | 255.255.255.192 | 64 | 62 | |
| /27 | 255.255.255.224 | 32 | 30 | |
| /28 | 255.255.255.240 | 16 | 14 | |
| /29 | 255.255.255.248 | 8 | 6 | |
| /30 | 255.255.255.252 | 4 | 2 |
The number of usable device addresses is 2(32 − prefix) − 2 (the network and broadcast addresses are not assignable). A quick method for the last octet: the block size is 256 minus the mask value, and subnets start at multiples of the block size. For mask 255.255.255.192 the block size is 64, so the subnets start at .0, .64, .128 and .192.
Worked example: splitting a network into four
A machine builder has 192.168.10.0/24 and wants four separate subnets of up to 60 devices. Four subnets need 2 extra network bits (22 = 4), so the prefix is /26 (mask 255.255.255.192), with 26 − 2 = 62 usable addresses each.
| Subnet | Usable addresses | Broadcast | Use |
|---|---|---|---|
| 192.168.10.0 / 26 | 192.168.10.1 to 192.168.10.62 | 192.168.10.63 | PLC and I/O |
| 192.168.10.64 / 26 | 192.168.10.65 to 192.168.10.126 | 192.168.10.127 | Drives |
| 192.168.10.128 / 26 | 192.168.10.129 to 192.168.10.190 | 192.168.10.191 | HMI and SCADA |
| 192.168.10.192 / 26 | 192.168.10.193 to 192.168.10.254 | 192.168.10.255 | Spare |
Worked example: are they on the same subnet?
- With mask 255.255.255.192, is 192.168.10.70 on the same subnet as the PLC at 192.168.10.10? The PLC is in the 192.168.10.0 block (addresses 0 to 63); 70 is in the block starting at 64. Different subnets: they cannot talk directly and need a router.
- Is 192.168.10.40 on the PLC’s subnet? 40 is in 0 to 63. Yes, the same subnet.
- A widely-used shortcut: write both addresses in binary, apply the mask, and compare the results. Equal means same subnet. This is exactly what a device does before sending a packet.
Worked example: widening the mask to join two ranges
- A PLC at 192.168.1.10 and a drive at 192.168.2.30, both with mask 255.255.255.0, are on different subnets (1.0 and 2.0) and cannot talk without a router.
- Changing both masks to 255.255.252.0 (/22) makes one subnet from 192.168.0.0 to 192.168.3.255 (network 192.168.0.0, broadcast 192.168.3.255), so 192.168.1.10 and 192.168.2.30 are now neighbors. A /22 has 1 022 usable addresses; the mask must change on every device in the range.
- A /23 (255.255.254.0) joins just two /24 ranges and gives 510 usable addresses. The simpler fix is to give the drive 192.168.1.30 with the original mask.
Gateways and routing
A device sends directly only to addresses in its own subnet. For any other address it sends the packet to its default gateway, a router on its own subnet, which forwards it. That needs the router’s address (the gateway) on both devices: the reply has to find its way back. A common fault is a device that can send out but never receives answers because its own gateway is blank or wrong.
- No gateway needed when all devices are on one subnet; leave it blank or 0.0.0.0. A wrong gateway can cause odd delays.
- Routers and firewalls are the controlled doors between subnets: they allow only the traffic you list (see Industrial Network Security).
- Static routes tell a router about a network that is not directly attached (for example a second machine network behind another router).
- Broadcasts and discovery do not cross routers. BOOTP, PROFINET DCP and many vendor browse tools work only on the local segment.
- Layer-3 switches route between VLANs at wire speed; a router on a stick does the same over one trunk.
Private addresses and NAT
| Range | Prefix | Addresses | Use |
|---|---|---|---|
| 10.0.0.0 to 10.255.255.255 | 10.0.0.0/8 | 16 777 216 | Large plants and companies |
| 172.16.0.0 to 172.31.255.255 | 172.16.0.0/12 | 1 048 576 | Medium networks |
| 192.168.0.0 to 192.168.255.255 | 192.168.0.0/16 | 65 536 | Machines and small networks |
| 169.254.0.0/16 | link-local | 65 536 | Self-assigned when no DHCP answers: a device with a 169.254 address has not got its real one |
| 127.0.0.1 | loopback | 1 | This computer itself |
Private addresses are not routed on the internet: they are for inside the plant. NAT (network address translation) in a router or firewall maps addresses between two networks. In industrial use it lets identical machines, each with the same internal addresses (192.168.10.x), connect to one plant network, each appearing there with a different address. 1:1 NAT maps one outside address to one inside address; many-to-one NAT hides a whole network behind one address. NAT is a convenience and not a security measure.
Assigning addresses: static, DHCP, BOOTP
| Method | How it works | Use for | Watch for |
|---|---|---|---|
| Static (manual) | You type the address into the device | PLCs, drives, HMIs, remote I/O: everything that other devices must find | Duplicates; keep an address list |
| DHCP | A server hands out an address, mask and gateway for a lease time | Laptops, phones, guests | A control device that depends on DHCP can change address after a power failure |
| DHCP reservation | The server always gives the same address to a given MAC | Control devices when you want central management | The server must be up at power-on |
| BOOTP | A device with no address asks a tool; the tool answers by MAC address | First commissioning of Rockwell and many other devices | Turn BOOTP off after assigning so that the address stays |
| DCP (PROFINET) | The controller assigns the address to the device that has the right name | PROFINET | The name must match |
| Link-local (169.254) | Self-assigned when nothing answers | Nothing deliberate | Means the address was not obtained |
- Reserve a range for DHCP (for example .100 to .199) and keep static addresses outside it.
- Use one convention: PLC at .10, HMI at .20, drives from .30, remote I/O from .40, laptops at .50 and up.
- Keep all devices of one machine in one subnet unless a router is part of the design.
Ports and the services behind them
An IP address finds a device; a port number (0 to 65 535) finds the program inside it. TCP ports belong to connections; UDP ports to datagrams. A firewall rule usually names a port.
| Port | Protocol | Used by | Notes |
|---|---|---|---|
| TCP 502 | Modbus TCP | Almost every brand | No security; keep inside the machine network |
| TCP 44818, UDP 2222, UDP 44818 | EtherNet/IP | Rockwell, Omron, many drives | Explicit messaging on 44818; I/O on 2222; discovery on UDP 44818 |
| TCP 102 | S7 communication | Siemens S7, HMIs, drivers | The S7-1200/1500 needs PUT/GET enabled |
| UDP 34964, 49152 and up | PROFINET (non-real-time) | PROFINET devices | RT frames use EtherType 0x8892, not IP |
| TCP or UDP 9600 | FINS | Omron | Configurable |
| TCP 4840 | OPC UA | Everywhere | Secure when configured; see OPC UA, MQTT and Industrial IoT |
| TCP 1883, 8883 | MQTT, MQTT over TLS | IoT gateways, brokers | Use 8883 |
| TCP 80, 443 | HTTP, HTTPS | Device web pages | Prefer HTTPS; disable if unused |
| UDP 161, 162 | SNMP | Monitoring | Use SNMPv3 where possible |
| TCP 22, 23 | SSH, Telnet | Administration | Telnet is unencrypted: disable it |
| TCP 3389 | Remote Desktop | Windows engineering PCs | Never expose to the internet |
| UDP 67, 68 | DHCP, BOOTP | Address assignment | Broadcast-based; local segment only |
| UDP 123 | NTP | Time synchronization | Needed for correct timestamps in logs |
VLANs
A VLAN (virtual LAN, IEEE 802.1Q) divides one physical switch into several separate networks. Each port is assigned to a VLAN; frames are tagged with a VLAN number (1 to 4094) when they travel on a trunk port between switches, and devices in different VLANs can talk only through a router. VLANs keep control traffic apart from everything else without separate switches.
| Term | Meaning |
|---|---|
| Access port | Belongs to one VLAN; the device on it knows nothing about VLANs |
| Trunk port | Carries several VLANs between switches or to a router, with a tag on each frame |
| Native / untagged VLAN | The VLAN whose frames travel without a tag on a trunk; a mismatch between two ends is a classic fault |
| VLAN ID | The number 1 to 4094; use the same numbers everywhere |
| Inter-VLAN routing | A router or layer-3 switch forwards between VLANs under your firewall rules |
| Priority tag (802.1p) | Three bits in the tag that give real-time frames priority (PROFINET RT uses 6) |
- Plan the VLANs on paper: a number, a name, a subnet, a purpose.
- One VLAN, one subnet. Map each VLAN to its own IP subnet.
- Leave real-time protocols inside one VLAN: PROFINET RT, EtherCAT and DCP discovery do not cross routers.
- Disable unused ports or put them in an unused VLAN.
A machine-network design
| Device | Address | Role | Allowed from the plant network |
|---|---|---|---|
| PLC | 192.168.10.10 | Controller; Modbus TCP server and EtherNet/IP adapter | TCP 44818 and 2222 from SCADA; TCP 502 only from the historian |
| HMI | 192.168.10.20 | Operator panel | Web (HTTPS) from the engineering station only |
| Drive 1, Drive 2 | 192.168.10.30, .31 | Servo and VFD | None; reached only by the PLC |
| Remote I/O | 192.168.10.40 | Distributed I/O | None |
| Laptop | 192.168.10.50 | Service connection | Plugged in during service only |
| Firewall | 192.168.10.1 | 10.20.30.5 | Machine side and plant side | The rules in this table |
The same layout can be copied to every machine: the internal addresses are identical, and NAT gives each machine one address on the plant network. See System Integration for putting several machines together.
Command-line tools for checking
| Command (Windows) | What it tells you | Reading the result |
|---|---|---|
ipconfig /all | The laptop’s own addresses, masks and gateways | Is the laptop on the right subnet? Are several adapters active? |
ping 192.168.10.10 | Does the device answer at the network layer? | Replies and times prove cable, address and subnet; “Request timed out” means no answer; “Destination host unreachable” means no route |
ping -t 192.168.10.10 | A continuous ping | Wiggle a cable and see when the replies stop |
arp -a | The IP and MAC pairs the PC knows | A device that appears twice, or the same MAC for two IPs, shows a duplicate IP |
tracert 10.20.30.50 | The routers a packet passes through | Shows where the path ends |
netstat -an | Open connections and listening ports on the PC | Is the connection to port 502 established? |
Test-NetConnection 192.168.10.10 -Port 502 (PowerShell) | Is a TCP port open? | TcpTestSucceeded True means something is listening |
nslookup name | Name to address | Rarely needed on a machine network |
Some devices do not answer ping (a setting or a firewall), so a failed ping does not always mean the device is dead; check the link light and ARP too.
Setting the address on each platform
| Platform | How the address is usually set | Notes |
|---|---|---|
| Allen-Bradley Logix | BOOTP/DHCP tool, Studio 5000 (port configuration), RSLinx, or module switches | A new device may have BOOTP enabled: assign an address, then disable BOOTP so that it keeps it |
| Allen-Bradley Micro800 | Connected Components Workbench (Ethernet), or BOOTP | Stored in the controller |
| Siemens S7-1200/1500 | TIA Portal device configuration; Online and diagnostics; PRONETA; device name for PROFINET devices | For S7 communication enable PUT/GET access |
| Mitsubishi iQ-F, iQ-R | GX Works3 module parameters, then write to the PLC | Protocol ports are separate from the IP address |
| Omron CP, CJ, NX, NJ | CX-Programmer or Sysmac Studio, first over USB or serial | FINS node numbers follow the last IP number by default on some units |
| IDEC FC6A | WindLDR communication settings | Protocols enabled separately |
| Unitronics Vision, UniStream | SetIP utility or the hardware configuration | IP and port settings are in the project |
| AutomationDirect Click, Productivity | The programming software’s communication settings | Modbus TCP is built in |
| CODESYS-based | The device’s web page, the CODESYS gateway or a vendor tool | Varies by vendor |
The steps and menu names change between software versions; check your manual. The principle does not: put the PC on the same subnet, find the device (by its MAC address or a browse), assign a fixed address, save it, and check with ping. Step-by-step recipes are on Connecting PLCs, Drives and HMIs.
An address plan template
| Device | Location | IP address | Mask | Gateway | MAC | Name / unit ID | Protocol and port |
|---|---|---|---|---|---|---|---|
| PLC_1 | Panel A | 192.168.10.10 | 255.255.255.0 | 192.168.10.1 | 00:1B:1B:… | plc1 | EtherNet/IP 44818 |
| HMI_1 | Door | 192.168.10.20 | 255.255.255.0 | 192.168.10.1 | … | hmi1 | S7 / OPC UA |
| VFD_1 | Panel B | 192.168.10.30 | 255.255.255.0 | (blank) | … | unit ID 1 | Modbus TCP 502 |
| (blank row) |
Keep the real table with the drawings, and update it on every change. Add serial devices on a second table: station address, baud rate, parity, stop bits, register map reference.
Common mistakes
| Mistake | What you see | Fix |
|---|---|---|
| A different subnet from the PLC (laptop on 192.168.0.x, PLC on 192.168.1.x) | No ping, software cannot find the device | Set the laptop to the PLC’s subnet |
| A duplicate IP address | A device drops in and out; ARP shows two MACs for one IP | Find the other device; fix the address list |
| Wrong mask on one device | It can talk to some devices and not others | Check the mask on every device |
| No gateway (or a wrong one) on a device across a router | Requests arrive; replies never return | Set the correct gateway on both sides |
| DHCP address changed after a power cycle | The HMI and PLC lose contact | Use a static address or a reservation |
| BOOTP left enabled | The device returns to a different address after a power cycle | Disable BOOTP after assigning |
| Two network cards on the laptop on the same subnet | The software uses the wrong one | Disable Wi-Fi or set the adapter order |
| Broadcast tools used through a router | The device is not found though it is there | Connect the laptop to the same subnet |
| Port blocked by a firewall | Ping works but the protocol fails | Open the port (and only that port) |
Related
- Industrial Communication: the overview of this guide.
- Industrial Ethernet: EtherNet/IP, PROFINET and EtherCAT: the protocols that run over IP.
- Industrial Network Security: firewalls, zones and remote access.
- Troubleshooting Industrial Networks: a step-by-step method when devices cannot be reached.
- IP and Subnet Calculator (if built).
FAQ
What mask should I use?
The one that is on every device of the machine: 255.255.255.0 (/24) is the usual default. Use a smaller subnet (/26 or /27) only when you want to divide a range, and then change the mask on every device in it.
Why can I ping the PLC but not connect with the programming software?
Ping proves layers 1 to 3. The software uses a TCP port and a protocol: check the port is open, the protocol settings (for example the right driver, PUT/GET access) and any firewall.
Why does my device have a 169.254 address?
It asked for an address (DHCP or BOOTP) and nobody answered, so it gave itself a link-local one. Assign a static address, or fix the DHCP server.
Do I need a default gateway?
Only if the device must talk to another subnet. For devices on one machine network, leave it blank.
Should I use VLANs on a small machine?
Not necessarily. A small machine can be a single flat subnet. Use VLANs when different kinds of traffic share one switch, or when a plant policy requires separation.
What is the difference between a switch and a router?
A switch connects devices on the same subnet. A router connects different subnets. Many managed switches also route between VLANs (layer 3).
References
- RFC 791, Internet Protocol; RFC 950, Internet Standard Subnetting Procedure; RFC 4632, Classless Inter-domain Routing (CIDR).
- RFC 1918, Address Allocation for Private Internets; RFC 2131, Dynamic Host Configuration Protocol; RFC 951, Bootstrap Protocol (BOOTP).
- IEEE 802.1Q, Bridges and Bridged Networks (VLANs).
- Rockwell Automation, EtherNet/IP Network Devices User Manual (ENET-UM006) and Converged Plantwide Ethernet (CPwE) Design and Implementation Guide (with Cisco).
- Siemens, PROFINET with STEP 7 and S7-1200 System Manual.
Last reviewed: October 2026. Speeds, lengths, node counts and menu names are typical: confirm against the specification and the manufacturer’s documentation for the devices you use.