diff --git a/pkg/rings/rings.go b/pkg/rings/rings.go
index 73a819f..6b36e17 100644
--- a/pkg/rings/rings.go
+++ b/pkg/rings/rings.go
@@ -23,6 +23,9 @@ const (
 	RingZeroBits = 16
 	// RingOneBits indicates the size of the prefix on the ring 1 (lan) network.
 	RingOneBits = 20
+	// RingTwoBits indicates the size of the prefix on the ring 2 (services) network
+	// of all kubernetes clusters.
+	RingTwoBits = 20
 	// RingThreeBits indicates the size of the prefix on the ring 3 (pods) network
 	// of the kubernetes cluster of a region.
 	RingThreeBits = 12
diff --git a/pkg/rings/two.go b/pkg/rings/two.go
new file mode 100644
index 0000000..0b702e1
--- /dev/null
+++ b/pkg/rings/two.go
@@ -0,0 +1,19 @@
+package rings
+
+import "net/netip"
+
+// RingTwoPrefix represents the services of a cluster
+//
+// Ring 2 subnets are of the form `10.(region_id).0.0/20`,
+// using the address space that would belong to the ring 3
+// region_id 0.
+func RingTwoPrefix(region RegionID) (cidr netip.Prefix, err error) {
+	switch {
+	case !region.Valid():
+		err = ErrOutOfRange(region, "region")
+	default:
+		addr := AddrFrom4(10, uint(region), 0, 0)
+		cidr = netip.PrefixFrom(addr, RingTwoBits)
+	}
+	return cidr, err
+}