1

The Situation

I have a Netgear WGR614v7 router (wireless disabled).

Hosts in both subnets should have internet access but should not be able to ping hosts across the subnets.

I want to split my private class c network into two subnets:

  1. First Subnet:
    • Subnet Mask: 255.255.255.128
    • Subnet Address: 192.168.0.0
    • Broadcast Address: 192.168.0.127
    • Host range 192.168.0.1 - 192.168.0.126
    • Default gateway 192.168.0.1
  2. Second Subnet:
    • Subnet Mask: 255.255.255.128
    • Subnet Address: 192.168.0.128
    • Broadcast Address: 192.168.0.255
    • Host range: 192.168.0.129 - 192.168.0.254
    • Default Gateway: 192.168.0.1 (I think this is wrong?)

Router Configuration

Router configuration ("LAN IP Setup" tab on the WGR614v7 - looks a lot like this http://interface.netgear-forum.com/WGR614v6/start.htm):

LAN TCP/IP SETUP

  • IP Address: 192.168.0.1
  • IP Subnet: Mask 255.255.255.128 (Maybe I should change this on the router to /24 instead of /25 and put /25 masks on the hosts??)
  • RIP Direction: None
  • RIP Version: Disabled
  • Use Router as DHCP Server: Enabled
  • Starting IP Address: 192.168.0.50
  • Ending IP Address: 192.168.0.99
  • Address Reservation: None

The workstations

I have a workstation in the 1st network (192.168.0.51 via DHCP) which has internet access no problem.

A workstation in the 2nd network (192.168.0.129 via static IP) can't reach the internet nor can it ping the router (192.168.0.1).

The Main Question

Can you please help me find out what I'm doing wrong? I am trying to find out why I can't put that second workstation (192.168.0.129) on the second subnet and access the internet from it or ping the router.

  • 2
    Of course this won't work... you have no gateway WITHIN the subnet of 192.168.0.128/25, the gateway you have listed for that subnet resides in 192.168.0.0/25, your PC at .129 has no valid gateway to leave it's subnet. (EDIT: Sorry, that came across quite crass, it was not intended that way) – acejavelin May 10 '16 at 1:53
  • No problem. I'm a obviously noob so any feedback is good feedback. So does every subnet need it's own router? – Rhyknowscerious May 10 '16 at 2:05
  • 2
    Yes, every subnet needs a gateway (router), that is how traffic leaves the subnet. A host only knows about addresses within it's own subnet, it doesn't know about how to get to anything outside of it's subnet. This is technically due to it's subnet mask in binary, but in practice it basically means every network (subnet) needs a gateway (router) for any traffic to leave the network, and that gateway must reside within that subnet because those are the only hosts (addresses) it knows how to get to. – acejavelin May 10 '16 at 2:12
  • Perhaps your router supports a wired guest network. If it doesn't, you're out of luck. It's a consumer device after all. – Daniel B May 10 '16 at 4:43
3

I don't think you can properly do what you are trying to with your current router (unless you can upgrade it to OpenWRT or equivalent.). Its also A LOT harder to do then you think - and probably can't be done through the web interface alone.

As has already been pointed out, each subnet needs to point to the router with an IP in its own netblock.

Thus on LAN Interface of the router you need to have 2 IP addresses - 192.168.0.1 and 192.168.0.254 (or, in the second case, an Ip address in 192.168.0.129 - 192.168.0.254 which you are not using). In order to do this you need to bind a second IP address to the router, and it does not appear to allow you to do this.

Even if you do achieve the above, you are still only part way to your goals. If you are using DHCP, you need to have the DHCP server answer on both subnets, and provide IP's in the appropriate range for each subnet. Again, this is doable but probably not with your current router.

The question to ask though is "Why are you doing this". Doing this does not buy you any significant security/isolation because the systems are still on the same segment, ie computers in one half can read and respond to broadcast traffic in the other half. The typical way of handling this problem is thus a bit more complex - and again, you need more powerful router software to pull it off. (In order to fully understand what I'm going on about here, you need to understand the difference between a subnet and network segment - the 2 concepts go hand-in-hand, and generally 1 subnet=1 segment, but you are describing 2 subnets on 1 segment - which is often not what you want)

The way I have done something similar is thus - I got a router which supported OpenWRT. I configured the LAN ports on the router into different VLANS. (Most 4 port routers are interesting in as much as the 4 lan ports are actually individually accessed, and the software makes them appear as a switch and interchangeable - but you can actually program them to be on different VLANS, and provide per-port isolation). You then put each VLAN in a different subnet, and assign an IP address to the router interface for each subnet. You will probably need 2 switches (if you have more then 3 devices in any subnet) - you would need to use 1 of the switches for each subnet. In this way computers are in different network segments and - from a practical POV - can't talk to each other without going through the router. [ That said, I can point you to articles which say don't rely on VLANS for security - although I don't agree with their conclusions ]

  • You asked why I'm doing this. I'm trying to learn how to subnet simply for the purpose of learning. I don't have a lot of money to spend on certifications and expensive equipment at the moment, so I'm just trying to utilize the resources that are currently available to me. I'm extremely fascinated by this stuff and really want to start a career in networking eventually. I do have two routers but maybe my consumer grade equipment simply isn't capable. Do you know what the minimal amount and types of hardware I'd need to setup a 2-subnet network? – Rhyknowscerious May 10 '16 at 4:11
  • If you really want to set up a 2 subnet network on the cheap, you want equipment which can run *wrt - dd-wrt is probably the easiest bet, and runs on many routers. (Have a look at dd-wrt.com/wiki/index.php/Detached_Networks_using_VLAN for how to create individual networks for each LAN card with it), and dd-wrt.com/wiki/index.php/Supported_Devices for a list of supported devices. – davidgo May 10 '16 at 4:25
  • Ok. I'll definitely give dd-wrt a try. I've been curious for a long time but haven't owned any compatible equipment. But before I give up on my current equipment, I have a few more questions: I do have another router (Linksys BEFSR41v2). Would this work by statically addressing all hosts instead of DHCP and using static routes or dynamic routes between routers (I'm still learning what all this even is)? Would it help to use RIPv2? I'm just naming settings/features that look relevant because I really hoped I could use what I've already got. If not, I understand-if it won't work, it won't work. – Rhyknowscerious May 10 '16 at 4:35
  • 2
    Using static IP's will solve the DHCP problem. I would not recommend trying to handle dynamic routing (eg RIPv2) until you have static routing sorted - and its unlikely to help in this environment anyway. Don't know about the BEFSR41v2, but I'd be surprised if it could do what you are trying to do. If you have any spare computers with extra network cards, you can build quite a powerful router with those using Linux (or similar) if you have the knowhow. – davidgo May 10 '16 at 5:11
  • I love Linux and that sounds fun. I'll definitely have to try that when I have some time. – Rhyknowscerious May 10 '16 at 6:20
1

I'm really sorry to do this but I just answered my own question by setting up a static route. I just pretty much followed these directions but tweaked a little: https://www.dd-wrt.com/wiki/index.php/Linking_Subnets_with_Static_Routes

On the first router (Netgear WGR614v7) here's the static route config:

  • Private: yes
  • Active: yes
  • Destination IP Address: 192.168.0.128
  • IP Subnet Mask: 255.255.255.128
  • Gateway IP Address: 192.168.0.2
  • Metric: 2

There's an ethernet cable running from the LAN port on the Netgear to the WAN port on the Linksys.

Now here's the 2nd router's config (Linksys BEFSR41v2):

LAN IP Address

  • Device IP Address: 192.168.0.129
  • Subnet Mask: 255.255.255.128

WAN IP Address (You can use DHCP from Netgear but I used static):

  • WAN IP Address: 192.168.0.2
  • Subnet Mask: 255.255.255.128
  • Default Gateway: 192.168.0.1
  • DNS: (Just use whatever your ISP gave you)

I enabled dhcp on both routers and I can't believe it worked.

  • On the Netgear I set the range from 192.168.0.50 to 192.168.0.99
  • On the Linksys I set the range from 192.168.0.150 to 192.168.0.199

All hosts from both networks have internet access.

One thing I noticed is that hosts from the first subnet (192.168.0.0/25) cannot ping hosts from the second subnet (192.168.0.128/25) but hosts from the second subnet can ping hosts from the first.

I'd like the subnets to be mutually exclusive to each other but that will have to be another question.

Edit: The static route is completely unnecessary for a minimal setup for mutually exclusive subnets. Just make sure to power cycle the routers after configuring them if they don't work. Here's how I found out: http://www.linksys.com/ca/support-article?articleNum=132275#b

  • 1
    I wasn't aware you had access to 2 routers, this would have been useful knowledge. :) – acejavelin May 10 '16 at 14:37
  • @acejavelin I'm sorry. I was typing responses here, researching there, and configuring/reconfiguring/reconfiguring my network. I should have mentioned it as soon as I found out that every subnet needs a gateway. If you repost your comment (when you first told me that) as an answer, I'll mark it as the solution. – Rhyknowscerious May 10 '16 at 18:30
  • You should edit your question to include this information. It will help explain why your answer is marked accepted instead of the more thorough answer by @David – Twisty Impersonator Sep 15 '18 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.