Office subnet and DHCP
Plan office addresses and configure your local DHCP server.
Traffic path
Office devices use your office router as their default gateway. That router sends Internet traffic through WireGuard to Loclix.
Set DHCP's router option to the office router's LAN address. The remote Loclix tunnel address is used for DNS, not as the devices' local gateway.
Subnet generation
- Open the interconnect's Connection view.
- Enter the estimated Client devices count.
- Select Generate office subnet.
- Review Office IPv4 subnets before saving.
The generator chooses the smallest supported subnet with room for your clients and one router. It excludes network and broadcast addresses.
| Client devices | Prefix | Available client addresses |
|---|---|---|
| 1 | /30 | 1 |
| 50 | /26 | 61 |
| 253 | /24 | 253 |
| 254 | /23 | 509 |
Estimates from 1 to 65,533 devices produce prefixes from /30 to /16. This sizes the address range; it does not set a device quota or reserve bandwidth.
The generator avoids subnets already saved in your account. Check for conflicts with your other local networks and static addresses. Generation changes only the draft: you must save it and configure your network separately.
If your office already has a suitable subnet, keep it. Generation is optional.
DHCP configuration
Run DHCP on your office router or a server on the LAN. When the draft has one supported private subnet, Office DHCP plan reserves its first usable address for the router and lists the remaining address pool.
For an office using 192.168.10.0/24, a plan might look like this:
| Setting | Example |
|---|---|
| Subnet mask | 255.255.255.0 |
| Office LAN gateway, DHCP option 3 | 192.168.10.1 |
| DHCP pool | 192.168.10.2–192.168.10.254 |
| DNS server, DHCP option 6 | 100.126.1.1 |
Use the DNS address shown for your saved interconnect, which can differ from this example.
- Assign the LAN gateway address to your router.
- Exclude existing static addresses and reservations from the DHCP pool.
- Set DHCP option 3 to the router's LAN address.
- Set DHCP option 6 to the supplied tunnel DNS address.
- Route office Internet traffic through WireGuard without source NAT.
WireGuard provides a routed connection, so DHCP broadcasts stay on your office LAN. This interconnect uses one router peer for the office, rather than separate peers for each device.
Source addresses and bypass
Preserving client source addresses lets Analytics report usage per IP. DHCP DNS settings alone cannot stop devices from using encrypted DNS. Apply the router and device controls your office requires.