Isolating tenant workloads within a single /24 subnet prevents lateral movement without wasting IPv4 allocations. Here is how we deployed and maintained Linux bridge port isolation and Private VLANs across 48 hypervisors over six months.