192.168.0.0/16: the home and small-office private range

Size and structure

The mask 255.255.0.0 fixes 192.168 and leaves the last two octets: wildcard 0.0.255.255, 2^16 = 65,536 addresses. The calculator classifies it as "Private (RFC 1918)".

In practice the third octet is a subnet number. The block holds 256 /24s, 192.168.0.0/24 to 192.168.255.0/24, and almost no one uses it as a single /16 network.

Where it shows up

Consumer routers ship with 192.168.0.0/24 or 192.168.1.0/24 as the LAN, with the router at .1. Phone hotspots, printers in setup mode and lab appliances use other low 192.168 subnets. Calico's default Kubernetes pod pool is 192.168.0.0/16, and Docker falls back to /20s from this range once its 172 pool is exhausted.

Why to keep company networks out of it

Because every home network is a 192.168 /24, a corporate subnet in the same range collides with remote workers' LANs. If an office uses 192.168.1.0/24 and an employee's router does too, the VPN client cannot tell which 192.168.1.20 is meant; local traffic usually wins and the office server becomes unreachable.

Use 10/8 or 172.16/12 for anything that must be reached over a VPN, and if 192.168 is unavoidable, pick a high, unusual third octet such as 192.168.213.0/24.

Using it in firewall rules

As an ACL wildcard, the block is 192.168.0.0 0.0.255.255. Filters at the network edge commonly drop packets from the internet that carry RFC 1918 source addresses, since a packet claiming to come from 192.168 space on a public interface is spoofed or leaked.

Inside a network, a blanket rule allowing 192.168.0.0/16 is usually broader than intended. Allow the specific /24 a service needs, so a guest or IoT subnet elsewhere in the block does not inherit access by accident.

The same caution applies to split-tunnel VPN profiles. Sending all of 192.168.0.0/16 through the tunnel hijacks the user's own home LAN, so their printer and router vanish while connected; push only the specific subnets the company actually uses.