I want to know why same IP with same mask on both WAN and LAN side could be a problem.

I also want to know if setting different mask, but having same IPs will resolve the routing problem.

Specifically are same IP addresses with different masks LAN: and WAN: problematic from routing and NAT point of view and why?

Are different IP addresses with same mask LAN: and WAN: problematic and why?

3 Answers 3


Specifically are same IP addresses with different masks LAN: and WAN: problematic from routing and NAT point of view and why ?

Yes, this is a problem, for routing in general.

Hosts on the LAN network will see the entire /24 as a CONNECTED route. Connected routes often have a special meaning, and can override more specific routes on remote networks. (what could get more specific than a host you have an ARP entry for?)

At a minimum, hosts on the LAN will be able to reach either the WAN subnet, or hosts on the LAN which are in the WAN range. (you could try adding a static route, for example.) But never both.

Also, WAN hosts will not be able to reach LAN hosts in the same IP range.

Some NATs (in particular, carrier-grade NAT) is capable of handling cases where the same subnet is on both the inner and outer side of the NAT. But obviously, this only works unidirectionally.

Are different IP addresses with same mask LAN: and WAN: problematic and why ?

This is not, and has never been problematic. Lots of networks have the same mask, and it's not a problem. At the time of this writing, there are 260,864 /24 networks in the global BGP table. The only reason why your specific example could be problematic is because it's shared RFC 1918 address space. So if you imagine two organizations using, and one organization buys out the other organization, then there will be problems.


Why can't I have the same subnet on WAN and LAN?

Directly answering this question I have to say you can have it — merging LAN and WAN on layer 2, with Ethernet bridge technique, as most of SOHO Wi-Fi routers usually do, but this effectively collapses two different IP interfaces into single one, just wider.

But since your direct question isn't the real question you want to have answer for, I shall let myself go further.

If we have the same logical (IPv4) network on several interfaces, there's a choice problem, when router has to send IPv4 packet to a host inside this LAN, what path should it choose? In one case it needs to send it on radio, on another — just put it in wire. Network IP-addresses are specifically made to solve that kind of choice.

P. S. Your question indicates you don't know the very basis things related to IP-addressing. I'm not going to be rude telling you to go read books, but, hey, there're books for reason, man.

  • 2
    Forums also exist for a reason. If people buy SOHO routers then they don't have time to read books and make conclusions from that reading. So far I've learned that many network experts love to send people to read books instead of answering questions and also often give contradicting to each other answers. It does not happen that much in other subject areas, not sure if it's because networking is too complicated or too simple. I think Mike's answer is better, but only you can decide if his answer is correct (please object if it's not), I just have to trust his information and accept it.
    – alpav
    Jan 23, 2014 at 3:45
  • 1
    @alpav, I prefer brief clarity. It has even more value when dealing with SOHO-questions. ;) And yeah, forums are for reasons like either "what book should I read?", or "something isn't covered with books, seemingly".
    – poige
    Jan 23, 2014 at 5:29

In general your question seem logical. If you're sitting in your house (LAN) and calling out for John, why would a butler (router) open the door and look for John somewhere outside (WAN)? If your brother is allowed to be the only John in the house, then by simply calling John, you'd be able to get your brother and only him. Since butler demands that your brother should also have a different surname (different subnet = different third octet) UK.London.Randall.John, so that he would be able to differentiate him from the potential outsider UK.London.Smith.John, that means that butler by default is not looking for John only in your house.

That is bizzare because in LAN>WAN configuration PC from the secondary router's subnet can't see the PC inside the main router's subnet. That means that even if you try to call the outsider by his full name UK.London.Smith.John you can't reach him. The only John you can reach is your brother John Randall. But if his surname doesn't differ from the surname of the guy that you can't possibly reach, you won't get him :)

I guess they had a pretty good reason to make it work like that. In the end a router was defined as a device that connects two different subnets, so it seems reasonable that it won't work proper until you make it so.

  • I was with you right up to "different subnet = different third octet". That's not how subnets work.
    – womble
    Nov 15, 2015 at 22:53
  • @womble Not general rule, but isn't this is the usual case with home routers? AFAIK everyone uses mask.
    – Cornelius
    Nov 17, 2015 at 0:45
  • This isn't a site for home routers, and no, not everyone uses a /24 on them.
    – womble
    Nov 17, 2015 at 0:58
  • @womble He is using standard and subnets, disregarding it being at home or school/business LAN. There is no point in making an answer different.
    – Cornelius
    Nov 17, 2015 at 1:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.