Understanding the 100.64.0.0/10 Address Space in Mesh Networks
An explanation of why prialo uses RFC 6598 IP addresses instead of standard RFC 1918 private ranges to prevent routing conflicts.
When building a private mesh network to connect devices like phones, Macs, and Linux servers, routing traffic securely is only half the challenge. The other half is ensuring that the IP addresses assigned to these devices do not conflict with the local networks they are already connected to. To achieve this, prialo uses WireGuard to encrypt point-to-point traffic and assigns each device an IP address within the 100.64.0.0/10 range. This design allows users to access their machines from anywhere without exposing open ports to the public internet. By creating a direct overlay network, users can establish direct communication channels between their systems, ensuring that sensitive administrative interfaces and services remain completely hidden from external scanners.
The Problem with Traditional Private IP Addresses
Most home routers, public Wi-Fi access points, and corporate local networks assign IP addresses using standard private ranges defined in RFC 1918. These typically include ranges like 192.168.x.x, 10.x.x.x, or 172.16.x.x to 172.31.x.x. When you connect to a coffee shop Wi-Fi, your laptop is likely assigned an address like 192.168.1.50. If your home server or office workstation is also on a local network using the 192.168.1.x subnet, your operating system faces an immediate routing conflict. It cannot distinguish between the local coffee shop network and your remote home network. Consequently, any traffic intended for your remote server is routed locally, resulting in connection failures and making remote access impossible without complex network reconfiguration.
Introducing the RFC 6598 Shared Address Space
To solve this overlap issue permanently, prialo utilizes the 100.64.0.0/10 address block. Documented in RFC 6598, this range is officially designated as the Shared Address Space. It was originally designed for Carrier-Grade NAT (CGNAT), which internet service providers use to share a single public IPv4 address among multiple subscribers. Because this range is specifically reserved for service provider routing and is explicitly not meant to be deployed on local home or office LANs, it is highly unlikely to conflict with any local network a device connects to. This makes it the ideal address space for virtual overlay networks, as it guarantees that the virtual network interface can coexist peacefully with any physical Wi-Fi or Ethernet connection.
How prialo Assigns and Manages These Addresses
When a device joins the prialo network, the control plane allocates a unique IP address from this 100.64.0.0/10 block. This allocation remains consistent for the device, acting as its permanent identity within the mesh. Since WireGuard manages the encrypted tunnels between these endpoints, the operating system knows exactly how to route traffic destined for any 100.64.x.x address through the secure virtual interface rather than the physical network interface. This ensures that your connections are always direct, secure, and isolated from the rest of the local network.
- Collision Avoidance: No overlap with standard 192.168.x.x or 10.x.x.x networks.
- Consistent Routing: Operating systems can safely route mesh traffic without confusing it with local LAN resources.
- No Public Exposure: The 100.64.0.0/10 range is non-routable on the public internet, keeping your nodes invisible to external scanners.
Verifying Your Mesh Interface
On Linux and macOS systems, you can inspect the active network interfaces to see the assigned address and the WireGuard routing rules. For example, on a Linux server, running the standard IP link and address commands reveals the virtual interface configuration.
ip address show dev prialo0This command displays the virtual network interface, showing the assigned 100.64.x.x address. By relying on this specialized address space and WireGuard's modern encryption protocol, the mesh network maintains stable, conflict-free connectivity across diverse physical networks. This technical foundation ensures that your devices can communicate securely, regardless of the local network topology they encounter.
Would you rather run your own server? Guide to the self-hosted prialo package