Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I appolgize in advance for any elementry questions, as it has been a LONG time since college and I had hoped to never subnet again... :)

I want to subnet a 192.168.1.x with 8 segments. Each will not comunicate with the other, but all will connect to the same gateway (192.168.1.1). Users, based on there ip address, will be able to see which ever one of the networks that they are addressed to (IE. host 192.168.1.23 with a subnet mask of 255.255.255.224 whould be able to see the 192.168.1.0 network, but not the 192.168.1.32 network.)

Is this workable? I would also like to have other users on the supernet, see all of the subnets.

share|improve this question
    
"Each will not communicate with the other" and "like to have other users on the supernet see all of the subnets" don't exactly go well together. Do you want no one to see the local subnets they're not directly on, or only some to see the local subnets? –  sysadmin1138 Oct 20 '10 at 21:36

5 Answers 5

You can easily subnet into 8 blocks of 32 address using a mask of /27 (255.255.255.224), however they won't all have the same gateway address as they'll be in different subnets of course. As for this supernet thing, it'll get complex because one side will be able to send to the other but not the reverse - bad idea, just route it properly.

share|improve this answer
    
+1 - Absolutely. VLANs aren't magical. They're just a way of partitioning physical switches into multiple logical switches. You still need multiple IP subnets and interfaces on your router in each subnet to make the whole thing work. –  Evan Anderson Oct 21 '10 at 1:00

Because 192.168.1.1 can only be used by one segment (it will be "outside" all but one segment) this won't work as stated. Each segment will need its own gateway IP (ie 192.168.1.32/27 will need 192.168.1.33 as a gateway).

If you're trying to use a netmask as security, don't. Use firewalls to physically separate the traffic between segments, allow traffic back and forth between the rest of the world while banning traffic to and from the other segments.

share|improve this answer

I would say, the question is kind of confusing, but looks like here is what you need

You need 8 machines to be able to talk to the same default gateway, but they should not be able to talk to each other.

If this is what you need, follow on...

  1. Devices can only have default gateway IP address only in the subnet that they are on. (so for example, if you need to have a GW and you give the IP address 192.168.0.5 and subnet mask 255.255.255.0 (/24) , Your gateway can only be in the range of 192.168.0.1 - 192.168.0.255 )

Having said the above, you can say you need them to be on the same VLAN and also on the same subnet.

Which leaves us with the second part of the problem, they should not be able to talk to each other.

Now there are various ways to achieve it, but the simplest is by using a concept of Private VLAN's (PVLAN's) for short. In cisco world you can deploy a full fledged PVLAN or use a switchport protected (which is also a rudimentary form of PVLAN)

So here is how you would do it on a cisco switch (I have taken vlan 2 as example)

interface fa0/0
switcport mode access 
switchport access vlan 2
switchport protected

Similarly do it for all the 8 ports, IP them normally as if in the same subnet. Remember that protected ports cannot talk to another protected ports

Protected Port <-- XXXX ---> Protected Port
Protected Port <-----------> Un Protected Port

So, though they will be in the same VLAN having same gateway, they will be isolated from each other. Remember, that in this case, no traffic will pass between them. If you want to deploy a full fleged PVLAN configuration or more info on how to do stuff

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008013565f.shtml

Let me know if you need more information

share|improve this answer

I haven't tried this in a very long time (back in Repeater days). A group of us tested using any valid IP not on our network as the gateway(GW) and it worked properly. If you think about it, it should.

When the workstation starts all it knows is the IP of the GW. So one of the first things it does is to ARP for the MAC address. The router correctly responds with its MAC since the IP is not on the local net. The workstation saves that MAC associated with the GW's IP.

Sometime later the workstation attempts to access an off net IP. Knowing it is off net it substitutes the routers MAC in the destination MAC and voila.

Like I said, it was long, long, ago, in a network, far, far, away...

share|improve this answer

From what you described you wanted to do is VLAN.

In that Case i would have a Default VLAN_0 where your Default Router lives. and 8 other VLAN's to segment your network. in that way all would access the gateway and non can access each other's segment.

share|improve this answer
    
as for "other Users" that can see all traffic they would just need to be a member of VLAN0-VLAN8 –  Xiuhtecuhtli Oct 20 '10 at 22:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.