eero Pro 7 Subnet Settings

Amazon eero Pro 7 Subnet Settings Guide

The Amazon eero Pro 7 is a Wi-Fi 7 mesh router designed for zero-configuration setup. Its default subnet is 192.168.4.0/22. Unusually, eero uses a /22 rather than the /24 common on competing routers, giving the system 1,022 usable addresses across its DHCP pool. This larger subnet accommodates smart homes with many devices without pool exhaustion.

Specifications¹

Default subnet configuration

eero's /22 default (192.168.4.0/22)² spans four /24 blocks: 192.168.4.x through 192.168.7.x. This provides 1,022 usable addresses, far more than the 254 of a standard /24. The larger pool prevents DHCP exhaustion in dense smart-home environments where dozens of IoT sensors, speakers, and appliances each claim a lease. Yet a /22 flat network means every connected device can reach every other. A compromised smart device has access to all 1,021 other addresses in the pool. Building on this, eero's Network+ feature (paid subscription) adds profile-based device segmentation, but true VLAN isolation requires a managed switch behind the eero.

When a /22 flat network makes sense

A flat /22 suits households with a single trusted zone where every device can freely communicate with every other. Smart-home ecosystems benefit from this openness during initial setup because mDNS and discovery protocols reach across the entire subnet without routing configuration. The tradeoff is that a compromised device can probe all 1,021 other leases, so /22 deployments work best when every connected device is trusted and firmware is kept up to date.

Changing subnet settings via the eero app

Open the eero app, tap Settings (gear icon) > Advanced Settings > DHCP & NAT. The current subnet and gateway IP are displayed. To change the subnet, tap the IP address and enter a new gateway IP and subnet mask. For example, setting 10.0.0.1 with 255.255.0.0 moves the network to 10.0.0.0/16 with 65,534 available addresses. Tap Save; the eero network restarts its DHCP service and clients must renew leases. Furthermore, DHCP reservations are available under the individual device settings. Tap a device in the app, then Reserve IP to bind a static address to that device's MAC so the device keeps the same lease even after it disconnects from the mesh for several days.

Choosing a non-default subnet on the eero Pro 7

Changing the subnet mask is uncommon on eero but useful when you want fewer addresses and a smaller broadcast domain for tighter device isolation. For example, switching the mask to 255.255.255.0 on a 192.168.4.0 configuration gives you a /24 with 254 usable addresses and a smaller flood scope. CapyToolkit's subnet calculator shows you the available address count for any gateway-and-mask combination before you apply changes in the eero app.

The same DHCP & NAT screen also exposes a NAT type toggle with three modes: automatic (eero manages NAT itself), custom (you define the NAT behavior manually), and bridged (NAT is disabled entirely so an upstream router handles it). Switching to custom NAT is the setting to use alongside a non-default subnet, since automatic mode assumes eero's own addressing scheme and can conflict with a manually chosen gateway and mask.

Multi-subnet and VLAN patterns

eero supports a guest network through the app. This creates a second SSID with its own isolated segment. Guest devices cannot reach the primary network but can access the internet. For full VLAN segmentation (IoT isolation, homelab servers, cameras), connect a managed switch to the eero's LAN port with IEEE 802.1Q VLAN tagging. Configure the switch with VLAN IDs matching intended trust zones and set the eero as the upstream gateway.

Planning CIDR blocks for each trust zone

Each VLAN receives its own CIDR block planned with the subnet calculator. IoT zones work well as /24 networks with 254 usable addresses, guest zones as /25 networks with 126 usable addresses, and management zones as /26 networks that limit exposure to 62 devices. Consequently, IoT sensors sit in a /24 that the switch blocks from reaching the personal device VLAN, while the main eero still routes internet-bound traffic for all VLANs.

Why eero chose /22 instead of /24 and what it means for you

Most home routers default to a /24 subnet (254 usable addresses).³ eero quadrupled that to a /22 (1,022 usable addresses) because modern smart homes routinely have 30 to 80 connected devices: phones, laptops, tablets, smart speakers, thermostats, cameras, smart plugs, TVs, and streaming sticks. A /24 exhausts in large households or multi-unit dwellings where neighbors' networks contribute devices that briefly roam onto the mesh. Building on this, the tradeoff is a larger broadcast domain: every ARP request from any device reaches all 1,021 other potential addresses. In practice, this rarely causes performance issues on modern Wi-Fi hardware, but it does mean compromised devices can scan a wider address space. If your household has fewer than 50 devices and you want smaller broadcast domains, switching to a /24 in the eero app reduces the address pool without affecting functionality.

Port forwarding and DHCP reservations on the eero Pro 7

The eero app's Reserve IP feature (under device settings) binds a MAC address to a fixed IP within the DHCP pool. This is critical for devices that need consistent addresses: a home server running Plex, a NAS that network shares reference, or a gaming console that needs inbound ports open. After reserving the address, navigate to Settings > Advanced Settings > Reservations & Port Forwarding to map external ports to that reserved IP. Building on this, eero+ (the paid subscription) adds advanced threat scanning and ad blocking at the DNS level, but port forwarding and DHCP reservation work without a subscription. The eero Pro 7's NAT table supports up to 20 simultaneous port forwarding rules; for server hosting needs beyond that scale, consider a dedicated gateway that gives you full iptables or pfSense control.

Bridge mode and using the eero behind a dedicated router

Placing the eero Pro 7 in bridge mode (Settings > Advanced Settings > DHCP & NAT > Bridge) disables its routing function and turns the mesh into a pure wireless access point. Your upstream router, whether a pfSense box, a UDM Pro, or an OpenWrt gateway, handles all subnetting, DHCP, firewall rules, and inter-VLAN routing without any configuration changes on the eero itself.

Building on this, bridge mode is the correct choice when you need proper VLAN segmentation, as eero's native firmware does not support VLAN tagging on its LAN ports. In bridge mode, eero's built-in security features (threat scanning, content filtering) still operate at the DNS level, but firewall rules must live on the upstream gateway where they can inspect traffic across all VLANs.

The eero app continues to manage Wi-Fi settings, firmware updates, and device profiles even when routing is disabled, which means you can adjust channel widths, pause client access, and push firmware to mesh nodes without touching the upstream routing stack. CapyToolkit's DHCP pool calculator helps determine the correct addresses to assign to eero nodes as static leases under the upstream router's subnet so each mesh unit keeps a consistent management IP even as wireless clients roam across different access points. Before you flip the eero to bridge mode, reserve a fixed IP for every eero Pro 7 node under the upstream router's subnet so each unit keeps that address as clients roam.