How to Physically Subnet a Network

Question

I’ve read many posts and articles describing how to logically create subnets (Pluralsight: Subnetting a Class C Address Using the Fast Way, Network Enginering: How to divide network into subnets? How to Subnet a Network ), and I grasp the concept of calculating the subnet mask. However, what’s left out of these informative guides is the practical application (understandable, the logic is universal, but every network is physically different).

My question is what hardware configuration is necessary to separate a network into multiple subnets?

Do I need to buy a router for each subnet with each configured to provide a subset of the available address? For example, 4 subnets 4 routers:
 Router 1 (192.168.0.0 - 192.168.0.63)
 Router 2 (192.168.0.64 - 192.168.0.127)
 Router 3 (192.168.0.128 - 192.168.0.191)
 Router 4 (192.168.0.192 - 192.168.0.256)

For internet access and intranetwork communication, does each router need to be connected to an additional router which connects to the internet?
  Modem --> Router1-->Router(2..n)
Or should a switch be used for this purpose? If using a switch, what is the correct connection:
  Modem-->Switch-->Router(1..n)
  Modem-->Router1-->Switch-->Router(2..n)?

Or am I completely off the mark in my assumptions? I’m thinking in terms of consumer networking equipment. Do I need some professional grade router designed for subnetting where each port is allocated to a different network? I tried changing the subnet mask in my Netgear Nighthawk router and all I accomplished was reducing the number of IP address available. I wasn't able to assign devices to IPs not in the router's subnet.

My intention is to segregate devices based on if they need internet access, local network resources, or both:
  1: Internet & Local Network: Computers and network devices accessed remotely
  2: Local Network Only: Fileserver, computer running backups and printer
  3: Internet Only: AV equipment, home automation devices and guests’ mobile devices

Answer 1

I think the key things to understand -

• Subnets are working "at a different layer" to physical networks. Although its common to match physical interfaces with subnets (and this is sometimes a practical requirement - especially on routers), very often they are not related.

• A subnet is a group of machines which can speak directly to each other without needing to talk to a router/gateway machines

Going into more depth and answering questions raised by your post -

• A single router can handle multiple subnets. If the systems are to be able to communicate with each other/the wide world, the router either requires to have multiple interfaces (typical SOHO routers don't do this, but are capable of doing it with firmware like dd-wrt) - one for each subnet including the subnet the Internet is accessible on, or it needs to be able to have multiple IP addresses (1 in each subnet) on a single interface - this is fairly common.

For Internet access everything needs to go through AT least 1 router - but very often only 1 router is required.

When it comes to using switches, it would be typical to either have computers on different subnets on different switches, or to use VLANS to create multiple virtual switches on a single switch. That said, it is possible to have everything plugged into a single unmanaged switch - although not great from a traffic management point of view, and you generally wouldn't use dynamic IP address assignment (DHCP) because setting up DHCP to work with this is a hard and limited.

With respect of "professional grade router" - one possible rule to live by - is only use routers which support DD-WRT and use that. If your external interface is not ethernet, connect your router to a modem (DD-WRT does not have great support for DSL Interfaces). DD-WRT turns cheap routers into professional grade ones.

It is correct that reducing the size of a subnet will reduce the number of devices you can add to it - A subnet defines a group of addresses (really thats all it does) - the larger the subnet, the larger the group of addresses.

Generally speaking, for an IP address to be used, it always needs to be in a subnet. (It is possible to hack around this, but almost always a very hard way of doing things and a very bad idea)

At the end of your post you have talked about your intentions - This is quite hard to do (regardless of using 1 or 2 routers), so you will probably need to learn more about firewalling. A thought - surely your AV equipment should be able to see your local computers so you can stream data to/from it?

A simpler solution may be to get a DD-WRT router which supports guest mode - this makes it easy to set up a second wifi SSID on your router which only has Internet access. It may be easier to put everything else on the same subnet, and run a firewall on the Fileserver and backup computer which limits connections to it to those IP addresses originating on the LAN.