diff --git a/pkg/rings/encode.go b/pkg/rings/encode.go
index 41d1062..d33197d 100644
--- a/pkg/rings/encode.go
+++ b/pkg/rings/encode.go
@@ -2,6 +2,43 @@ package rings
 
 import "net/netip"
 
+// RingZeroPrefix represents the backbone that connects gateways
+// of the different Ring 1 networks.
+//
+// The ring 0 network corresponds to what would be ring 2 for region_id 0.
+// 10.0.0.0-10.0.255.255
+func RingZeroPrefix(region RegionID, zone ZoneID) (cidr netip.Prefix, err error) {
+	switch {
+	case !region.Valid():
+		err = ErrOutOfRange(region, "region")
+	case !zone.Valid():
+		err = ErrOutOfRange(zone, "zone")
+	default:
+		addr := unsafeRingZeroAddress(region, zone, 0)
+		cidr = netip.PrefixFrom(addr, RingZeroBits)
+	}
+
+	return cidr, err
+}
+
+// RingZeroAddress returns a Ring 0 address for a particular node.
+//
+// A ring 0 address looks like 10.0.(region_id << 4 + zone_id).(node_id)/20
+func RingZeroAddress(region RegionID, zone ZoneID, node NodeID) (addr netip.Addr, err error) {
+	switch {
+	case !region.Valid():
+		err = ErrOutOfRange(region, "region")
+	case !zone.Valid():
+		err = ErrOutOfRange(zone, "zone")
+	case !node.ValidZero():
+		err = ErrOutOfRange(node, "node")
+	default:
+		addr = unsafeRingZeroAddress(region, zone, node)
+	}
+
+	return addr, err
+}
+
 // RingOnePrefix represents a (virtual) local network of a zone.
 //
 // Ring 1 is `10.(region_id).(zone_id << 4).(node_id)/20` network
@@ -39,6 +76,13 @@ func RingOneAddress(region RegionID, zone ZoneID, node NodeID) (addr netip.Addr,
 	return addr, err
 }
 
+func unsafeRingZeroAddress(region RegionID, zone ZoneID, node NodeID) netip.Addr {
+	r := uint(region)
+	z := uint(zone)
+	n := uint(node)
+
+	return AddrFrom4(10, 0, r<<4+z, n)
+}
 func unsafeRingOneAddress(region RegionID, zone ZoneID, node NodeID) netip.Addr {
 	r := uint(region)
 	z := uint(zone)
diff --git a/pkg/rings/encode_test.go b/pkg/rings/encode_test.go
index b0dcb24..0b404fc 100644
--- a/pkg/rings/encode_test.go
+++ b/pkg/rings/encode_test.go
@@ -6,6 +6,15 @@ import (
 	"testing"
 )
 
+func TestRingZeroAddress(t *testing.T) {
+	RZNTest(t, "RingZeroAddress", RingZeroAddress, []RZNTestCase{
+		{1, 1, 50, MustParseAddr("10.0.17.50")},
+		{1, 2, 50, MustParseAddr("10.0.18.50")},
+		{2, 3, 1, MustParseAddr("10.0.35.1")},
+		{2, 3, 300, netip.Addr{}},
+	})
+}
+
 func TestRingOneAddress(t *testing.T) {
 	RZNTest(t, "RingOneAddress", RingOneAddress, []RZNTestCase{
 		{1, 1, 50, MustParseAddr("10.1.16.50")},
diff --git a/pkg/rings/rings.go b/pkg/rings/rings.go
index 18b46a2..a02bd09 100644
--- a/pkg/rings/rings.go
+++ b/pkg/rings/rings.go
@@ -19,6 +19,8 @@ const (
 	// when its a gateway connected to Ring 0 (backbone).
 	NodeZeroMax = (1 << 8) - 1
 
+	// RingZeroBits indicates the size of the prefix on the ring 0 (backbone) network.
+	RingZeroBits = 16
 	// RingOneBits indicates the size of the prefix on the ring 1 (lan) network.
 	RingOneBits = 20
 )