Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to assign to an ethernet host via DHCP a subnet mask of only the host itself, e.g. Do common operating systems support this kind of configuration?

I'd like for the hosts to send all of their traffic to the router (and not directly to some other host on the same segment), but still for them to be able to communicate (so no "client isolation"); effectively creating a point-to-point link, but without any client-side configuration.

Update: My intention is to configure a home router running dd-wrt so that all the traffic has to pass through the IP stack on the router, so it can be filtered by some ipfilter rules. I'd hoped for a general solution, some standard way to implement point-to-point Ethernet connections that still can be automatically configured by DHCP for all commons operating systems.

Based on the responses so far, this doesn't seem to be that easy; I'll read some more about VLANs and then reconsider my plans.

share|improve this question
Can I ask why you want to do this? What benefit does this give you? – Driftpeasant Dec 2 '11 at 13:34
I want to be able to use a firewall between all the clients on the local network and especially reduce the amount of broadcast on the segment, while still allowing traffic on certain ports. – lxgr Dec 3 '11 at 12:40
up vote 12 down vote accepted

First of all, in order to create point-to-point link, you need at least 4 addresses, so you'll have to use a /30 mask. For example:

  • Network address:
  • 1st point address:
  • 2nd point address:
  • Broadcast address:

You'll have to place each host on a different /30 subnet and implement inter-subnet routing on your gateway.

Edit: You don't write much about your infrastructure or the scalability you want to achieve with this configuration. I suppose your router supports the use of subinterfaces.

Also, no additional client-side configuration will be required if you use a DHCP server in order to distribute the addressing scheme.

share|improve this answer
Looks like the cleanest solution, but it wastes three addresses. I was hoping for a way to somehow eliminate subnets altogether. – lxgr Dec 2 '11 at 11:37
It is clean, it gives you full control of the traffic exchanged in your network ( well as a single point of failure) and it works both for small and large number of network nodes -of course if you use this scheme for a large number of hosts your router will suffer a serious performance hit. That's the only major drawback I can think of. Another solution is to place each host on a different VLAN and implement inter-VLAN routing -you can have up to 4090 hosts and a big fat performance hit as well (if they're many). Assuming of course that you have a VLAN-capable switch. – dkaragasidis Dec 2 '11 at 11:56
The drawback would be a potential waste of IP addresses - I'm using private adresses, so in my case it's not a big deal, but how does that work with public addresses? VLANs sound like a nice idea - I'll check if my switch supports them. Would the configuration also be a /30 mask for all the hosts? If not, how do the clients know to send their packets to the gateway instead of using ARP and directly transmitting on the layer 2 interface? – lxgr Dec 3 '11 at 12:37
Keep in mind that not all switches support 802.11q (VLANs) and not all switches support a large number of VLANs. I can't describe the details of VLAN operation in something less than 600 characters. VLANs are isolated on layer 2, and inter-vlan communication occurs on layer 3. What do you mean how would that work with public IP addresses? – dkaragasidis Dec 3 '11 at 20:11
At my old university, I once requested a static IP for a host, and they assigned it a /30 public address like you described. I've always wondered whether there was any more efficient way to handle that (but they don't seem to have a lack of public addresses - every electric door opener has a public IPv4 address...). At my current university, all the users get a static, public IP by default, in a /16 subnet - but I can't see any ARP requests etc. on the network. I was always wondering how the clients know where to send traffic to another host on the same subnet in that environment. – lxgr Dec 4 '11 at 11:33

It is possible to assign everything, but I doubt this will work - especially with Windows clients. The common-sense-approach that works with Linux would go like this:

  1. configure the interface with the address and the correct subnetmask
  2. remove the local network route
  3. add an explicit route to the gateway via the interface
  4. add a default route via the gateway

It usually would require either manual configuration or scripting on the DHCP client side to do everything after 1.

You also should make sure your gateway is not going to send ICMP redirect messages to hosts - it usually would do this upon detecting that a host is trying to reach another host within the same network via the gateway (information is derived from the address/subnetmask combination of the router's local host-facing interface).

share|improve this answer

Use of a /32 netmask (either statically or via DHCP) seems to be an increasingly common default configuration applied by VPS providers* to Linux hosts — presumably to reduce broadcast traffic.

I'm not certain whether such a configuration would work as intended on a Windows-based host, but a working manual configuration of a Linux host looks something like this (for Debian flavours).


auto eth0
iface eth0 inet static
  up route add dev eth0
  up route add default gw

Whether or not such a configuration provided by DHCP would work reliably may be highly dependant on a distribution's network scripts. There is certainly some evidence of widespread support for this (e.g. NetworkManager) as shown in the following commit to the Dracut initramfs build tool:

[*] CheapVPS, 1&1 and Strato do this for example.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.