Best Practices for protecting multiple subnets / multiple sites (MPLS/VPN)


Multiple Site / Subnet Configurations

This article discusses best practices for protecting multiple subnets of machines with a Datto appliance.

This article is not meant to be a hard and fast "how to subnet" article, it simply wants to take into account different items to look for when setting a device up for multiple subnets.

Switch configurations

When deploying a Datto device with the intent to protect multiple subnets, inter-subnet communication is key.

If you have agents on a single subnet, a /24 mask ( is sufficient.

However, if you have agents that extend beyond the subnet, you'll need to make sure that you not only can communicate between the subnets, but that your subnet mask is appropriately set.


A device is deployed to a Class C network with 3 subnets:


If you want the Datto device to be able to see all 3 subnets, set the appropriate mask and gateway.

If your gateway is, make sure that the agents on the .10 and .100 subnets can at least recognize the gateway for the .1 subnet.

This requires a subnet mask of to account for the 3rd octet. Since these are all maintained within a class C space, this allows for all agents to communicate.

You can consolidate the mask to account for different classes and different schemas. Here are some high-level examples:

32 = X-network-bits + Y-host-bits
Addresses = 2 ^ Y-host-bits
CIDR        Total number    Network             Description:
Notation:   of addresses:   Mask:
/0          4,294,967,296             Every Address
/1          2,147,483,648           128 /8 nets
/2          1,073,741,824           64 /8 nets
/3          536,870,912           32 /8 nets
/4          268,435,456           16 /8 nets
/5          134,217,728           8 /8 nets
/6          67,108,864           4 /8 nets
/7          33,554,432           2 /8 nets
/8          16,777,214           1 /8 net
/9          8,388,608         128 /16 nets
/10         4,194,304         64 /16 nets
/11         2,097,152         32 /16 nets
/12         1,048,576         16 /16 nets
/13         524,288         8 /16 nets
/14         262,144         4 /16 nets
/15         131.072         2 /16 nets
/16         65,536         1 /16
/17         32,768       128 /24 nets
/18         16,384       64 /24 nets
/19         8,192        32 /24 nets
/20         4,096        16 /24 nets
/21         2,048        8 /24 nets
/22         1,024        4 /24 nets
/23         512          2 /24 nets
/24         256          1 /24
/25         128        Half of a /24
/26         64         Fourth of a /24
/27         32         Eighth of a /24
/28         16         1/16th of a /24
/29         8          5 Usable addresses
/30         4          1 Usable address
/31         2          Unusable
/32         1          Single host

Different Class Networks

If you have different class networks, you may need to utilize the secondary NIC of the device.


A device is deployed to a network that utilizes both Class C and Class B network schemas:


With this different class network, you may want to set up the primary NIC of the device to one subnet and then utilize the secondary NIC in order to capture traffic from the second network segment.

You can create an address that isn't being used to act as the focal point of backing up the agent. There won't be a gateway assigned to the secondary NIC that is created. That second NIC acts as the gateway for the agent to reach the device. Devices will always check in and send data offsite via the primary NIC (eth 0) of the device.

Backups Over VPN

This configuration is discouraged due to the instability of backups over VPN connections

While Datto devices support backups over VPN or MPLS, it is not the recommended configuration and may prove itself unreliable. There are many considerations to be had before deploying this kind of solutions for customers. There are many free VPN clients available for use.

While normal file transfers, desktop sharing, and work operations may be easily executed over a VPN, an image-based backup over a VPN connection brings many more items into consideration:

  • Triggering the backup image
  • Reading the disk to be backed up
  • Returning data to the Datto device.
  • Writing data across the tunnel to the device.
Reliable image based backups over VPN require a stable connection with plenty of bandwidth between the site and the Datto device. While a slower connection may be supported, we cannot guarantee the reliability of the backup transfers unless the minimum standards are met.
The minimum recommendation is a constant, uninterrupted 50Mbps VPN connection per 1TB of data between the server site and the Datto device.
If multiple agents are backing up over a single VPN, they need to be staggered to prevent connectivity loss.

Configuring Firewalls / Connections

Please ensure white lists exist to allow the server and device to make external connections detailed here: Datto IP Ranges.

When setting up the connection between the Datto appliance and the site where the VPN connection will reside:

  • Firewalls and routers should be configured to have a separate security zone that will allow traffic to and from the site without restriction or deep packet inspection.
  • Any possible WAN accelerators should be enabled to improve the transfer speeds.
  • A single tunnel should be dedicated as much as possible to the connection. No other traffic should be present.
  • Test the reliability of the VPN connection with regular speed tests to ensure that the connection has remained stable.
  • Run backups when activity on the protected machines and the traffic tunnel is at a minimum.

Was this article helpful?

1 out of 4 found this helpful

You must sign in before voting on this article.

Want to talk about it? Have a feature request?

Head on over to our Datto Community Forum or the Datto Community Online.

For more Business Management resources, see the Datto RMM Online Help and the Autotask PSA Online Help .

Still have questions? Get live help.

Datto Homepage