192.168.0.0/28 (7 Clients) 192.168.0.0 - 192.168.0.7

192.168.0.0/27 (Routing Nodes with Two IPs, eg. 192.168.0.[8-15] for client requests, and 192.168.0.[16-23] ceph osds)

192.168.0.16/28 (Ceph Nodes) 192.168.0.24 - 192.168.0.31

Result is that clients can't vulnerability scan ceph nodes, but can access via router nodes, without VLANs, without a single router, provided client and node calls are load balanced across the 0.8-0.23 scope.