diff --git a/pkg/rings/one.go b/pkg/rings/one.go
new file mode 100644
index 0000000..afba26a
--- /dev/null
+++ b/pkg/rings/one.go
@@ -0,0 +1,42 @@
+package rings
+
+import "net/netip"
+
+// RingOnePrefix represents a (virtual) local network of a zone.
+//
+// Ring 1 is `10.(region_id).(zone_id << 4).(node_id)/20` network
+// grouped under what would be Ring 2 for region_id 0.
+// There are 12 bits worth of nodes but nodes under 255 are special
+// as they also get a slot on Ring 0.
+func RingOnePrefix(region RegionID, zone ZoneID) (cidr netip.Prefix, err error) {
+	switch {
+	case !region.Valid():
+		err = ErrOutOfRange(region, "region")
+	case !zone.Valid():
+		err = ErrOutOfRange(zone, "zone")
+	default:
+		addr := AddrFrom4(10, uint(region), uint(zone)<<4, 0)
+		cidr = netip.PrefixFrom(addr, RingOneBits)
+	}
+	return cidr, err
+}
+
+// RingOneAddress returns a Ring 1 address for a particular node.
+//
+// A ring 1 address is `10.(region_id).(zone_id << 4).(node_id)/20`
+// but the node_id can take up to 12 bits.
+func RingOneAddress(region RegionID, zone ZoneID, node NodeID) (addr netip.Addr, err error) {
+	switch {
+	case !region.Valid():
+		err = ErrOutOfRange(region, "region")
+	case !zone.Valid():
+		err = ErrOutOfRange(zone, "zone")
+	case !node.Valid():
+		err = ErrOutOfRange(node, "node")
+	default:
+		n1 := uint(node) / 8
+		n2 := uint(node) % 8
+		addr = AddrFrom4(10, uint(region), (uint(zone)<<4)+n1, n2)
+	}
+	return addr, err
+}
diff --git a/pkg/rings/rings.go b/pkg/rings/rings.go
index 5a111a3..d14d93c 100644
--- a/pkg/rings/rings.go
+++ b/pkg/rings/rings.go
@@ -18,6 +18,9 @@ const (
 	// NodeZeroMax indicates the highest number that can be used for a [NodeID]
 	// when its a gateway connected to Ring 0 (backbone).
 	NodeZeroMax = (1 << 8) - 1
+
+	// RingOneBits indicates the size of the prefix on the ring 1 (lan) network.
+	RingOneBits = 20
 )
 
 // RegionID is the identifier of a region, valid between 1 and [RegionMax].