3

I am trying to build a home network with three routers and one switch. My search here and on the internet didn't yield much, partly due to every question being very specific and also me being a novice at this (at best).

I'd like to maintain two separate wireless LANs (such that devices are bot being broadcast to the other) on two subnets, while connecting both via cable to the router that connects to the internet. Trying to draft the wired network (with device types):

Internet <---> ZTE MC7010 [192.168.2.1/24] <---> NETGEAR GS105GE <--+--> TP-Link Deco X20 [192.168.1.1/23]
                                                                    |
                                                                    +--> HUAWEI AX3 [192.168.0.1/23]

So I've got three subnets (192.168.2.x, 192.168.1.x and 192.168.0.x), each with its own router and DHCP server. I've really tried to understand how to configure them (esp. the subnet masks), but I think I'm doing something inherently wrong here.

My goal is to access 192.168.0.x devices from 192.168.2.x subnet (and vice versa, but that's not my main concern). By setting the subnet masks of the two LAN routers to /23, I thought I could enable access to the respective subnets, but to no avail. Another concern is that, at the HUAWEI router, I can only plug the LAN cable into the WAN port (otherwise I can't get past the warning in the UI) and that I might be facing some firewall issues. However, I deactivated the firewall in the UI and checked for any other settings that could be causing issues, but didn't succeed.

Any ideas and help would be very welcome! I am really 'working' way beyond my knowledge here... ;)

4
  • Is the intent that literally one subnet cannot see the other, or is it that one should not be able to see the LAN, only the outside world - ie the internet. Guest mode on many routers will easily achieve the latter. Defining your actual needs would enable people to provide better answers, otherwise this smacks of XY Problem
    – Tetsujin
    Feb 19, 2022 at 11:06
  • 1
    Not sure I understand correctly, but I'd say it's neither of the two. The separate subnets are supposed to keep devices (like a TV) from being broadcast in the whole house (as in: I don't want my neighbour cast content to my TV). But certain devices (mainly IoT) I need to be able to access. I hope that's a bit clearer, sorry for lack of details.
    – liatorp
    Feb 19, 2022 at 11:22
  • 1
    Why would your neighbour be in your network at all?
    – Tetsujin
    Feb 19, 2022 at 11:24
  • It's a multi-family home, so I do trust them (to some extent, haha)
    – liatorp
    Feb 19, 2022 at 11:25

3 Answers 3

5

By setting the subnet masks of the two LAN routers to /23, I thought I could enable access to the respective subnets, but to no avail.

No, that's very nearly the opposite of how it works.

The subnet mask defines how large the device's (host's or router's) local subnet is. "Local" specifically means all the devices that can be accessed without going through a router (i.e. without using a "gateway") – purely through switches and Wi-Fi access points.

But by switching the subnet masks to these specific /23's, the address ranges of the TP-Link and the Huawei now overlap (it goes all the way from 192.168.0.0 to 192.168.1.255 on both routers).

This means that a device connected to the TP-Link now thinks that devices on the Huawei are local (even though they're not!) and will never try to use a gateway to reach them; it will only make a local ARP query (which will fail). So that's the opposite of what you want.

An important thing to note is that the subnet mask doesn't really make devices accessible at layer2 (i.e. directly via switches/APs); it only informs them about what IP addresses are expected to be accessible at layer2. The subnet mask needs to reflect physical topology – not the other way around.

(Also, this is not a problem with using /23; it is specifically a problem with overlapping networks. As long as the subnet address ranges do not overlap, a /24 or /23 or /19 or any other size would work equally well.)


To make this work (that is, while deliberately keeping the 3 subnets separate), first go back to non-overlapping networks (just switch the configuration back to /24), then configure static routes on each router, pointing them to all other subnets.

For example, the ZTE needs routes to 192.168.1.0/24 via the TP-Link as 'gateway', and to 192.168.2.0/24 via the ZTE. Note that the 'gateway' address must be the one facing the ZTE (because the ZTE already knows how to reach it) – i.e. the TP-Link's "WAN" address, not 192.168.1.1, is the "gateway" from ZTE's perspective.

Most likely, both the TP-Link and Huawei already have their "default" route pointing towards the ZTE router, so now they should technically already be able to reach each other's subnets by bouncing packets off the ZTE, but for better performance you should add static routes on them as well (i.e. from TP-Link directly to the Huawei subnet, and vice versa). Note that they don't need routes for the ZTE subnet as they're already directly in that subnet.

3
  • Thanks for this very well-written explanation! This makes things a lot clearer for me. Only that I am now wondering where to add those static routes (if even possible) in the pretty feature-limited UIs... but I guess that's another problem.
    – liatorp
    Feb 19, 2022 at 11:19
  • Many "home" routers just literally don't offer that option. In some cases you can work around, e.g. if a computer on ZTE network needs access to Huawei network, but ZTE doesn't allow customizing routes, then the same routes can be added on the computer directly (as Windows/Linux/macOS do allow it). And if the Huawei and TP-Link have routes to each other, then their networks can communicate without any involvement from ZTE as well. Feb 19, 2022 at 11:57
  • Judging by what I found on the internet, neither the TP-Link nor the Huawei Router support static routes... guess that leaves me with no other option than abandoning the separate subnets.
    – liatorp
    Feb 19, 2022 at 12:36
2

Starting with your original (corrected) network and dirkt's drawing:

192.168.1.0/24              192.168.2.0/24               192.168.0.0/24
  :                            |                             :
  :                            |                             :
  :... TP-Link Deco X20.    ---|                             :
  :  192.168.1.1  192.168.2.2  |                             :
  :                            |---    HUAWEI AX3        ....:
  :                            |   192.168.2.3  192.168.0.1  :
  :                            |                             :
  :                            |                             :
                               |
                           192.168.2.1
                          ZTE MC7010
                           <routable> -> Internet

Just to note some important things: 192.168.2.0/24 is the NETWORK address (all bits within the network part of the address should be zero) 192.168.2.1 is a MACHINE address -- here, I'm going to presume that it's the address of the ZTE on it's inside interface. Similarly, the TP-Link will have an inside address of 192.168.1.1 , and the Huawei will have an inside address 192.168.0.1

The other things that we'll need is to assign static OUTSIDE addresses to the TP-Link and the Huawei ... 'outside', in this case, being the interface on the ZTE's (inside) network. In this case, We've assigned the TP-Link an address of 192.168.2.2 and the Huawei an address of 192.168.2.3 . So now we have:

      internet -- <routable>  = ZTE     = 192.168.2.1 -- 192.168.2.0/24 
192.168.2.0/24 -- 192.168.2.2 = TP-Link = 192.168.1.1 -- 192.168.1.0/24 
192.168.2.0/24 -- 192.168.2.3 = Huawei  = 192.168.0.1 -- 192.168.0.0/24 

With -- indicating the network the interface is on and = being it's address there.

So, now everybody knows how to get to the 192.168.2.0 network, but nobody knows how to rout to the inside networks of the TP-Link and the Huwaei, so you need to add static routes. On the ZTE you need to add:

Name       Network           gateway
TP-Link   192.168.1.0/24 -> 192.168.2.2 
Huawei    192.168.0.0/24    192.168.2.3

On the TP-link, you can optionally add:

Name       Network           gateway
Huawei    192.168.0.0/24    192.168.2.3 =

On the Huawei, you can optionally add:

Name       Network           gateway
TP-Link   192.168.1.0/24    192.168.2.2 

The reason why I say that you can optionally add the static routes onto the TP-Link and the Huawei is that the ZTE should point them to each other when they try to forward packets through the ZTE to each other... but you just save the extra work when you add the extra static routes. (the subnets will also still be able to talk to each other, even when the ZTE is down)

2

In addition to the other answer:

Try to draw subnets as straight lines, make all interfaces on routers visible:

192.168.1.*/24              192.168.3.*/24               192.168.0.*/24
     :                            |                             :
     :                            |                             :
     :... TP-Link Deco X20     ---|                             :
     :  192.168.1.1  192.168.3.2  |                             :
     :                            |---    HUAWEI AX3        ....:
     :                            |   192.168.3.3  192.168.0.1  :
     :                            |                             :
     :                            |                             :
                                  |
                              192.168.3.1
                             ZTE MC7010
                              <internet>

(Edit to remove NETGEAR as it is a switch)

In that case, the network topology is simple: every subnet has a single gateway (here, with .1) which would also act as DHCP server, handing out the gateway address.

So you don't even need to distribute routes (which would be necessary for a more complicated topology).

In doubt, keep to the standard /24 subnets (192.168.*.* is big enough, use 10.*.*.* if you have to).


but I pretty much can't access anything

I wrote you don't have to distribute routes, but you need to set routes to 162.168.1.*/24 via 192.168.3.2 and 192.168.0.*/24 via 192.168.3.3 at least on the ZTE (and setting them on the two other routers is also recommended).

Did you do that? Did you also give the TP-Link and the HUAWEI static addresses, e.g. by configuring the DHCP in the ZTE?


I cannot configure static routes on the ZTE (nor on any other of the routers).

Do you have root access to any of the routers? Have you checked if you can install alternative firmware (e.g. OpenWRT) on any of the routers?

Can the TP-Link or the Huawei be configured to bridge the WLAN AP with a LAN interface, or is there always a separation? (If this is possible, you could get something else, e.g. a RaspPi or something with OpenWRT, to act as a router (in the original sense, forwarding IP packets) for the subnets).

2
  • Thanks for your remarks! (The Netgear is indeed a switch, so my ..2.* is the merged version) I moved back to all /24 (and without routes), but I pretty much can't access anything... 192.168.1.* can access 192.168.2.1 (gateway), but not 192.168.2.3 or 192.168.0.* ... :(
    – liatorp
    Feb 19, 2022 at 12:41
  • Sorry, I misread the "distribute"... To answer "Did you do that?" - No, because I cannot configure static routes on the ZTE (nor on any other of the routers). So without that, I guess I'm pretty much done with my plan...
    – liatorp
    Feb 21, 2022 at 9:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .