Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a network: and computers on the network have static IPs 192.168.31.*

I'd like to segregate 5 of those computers (say - and put them behind a router/firewall (ClearOS) with firewall rules to only allow outgoing traffic to and block traffic to the rest of the internet.

Can I setup a within the Class C network? = Network = Gateway to = computer IPs = Broadcast

share|improve this question
Wouldn't it be simpler to configure your main firewall/router to block outgoing traffic from those ip addresses? – joeqwerty Sep 4 '12 at 22:04

2 Answers 2

You don't even need to go so far as to subnet them off. It is possible to use your firewall on layer-2 and firewall across the bridge. The caveat here is that those 5 machines probably need to be on a different switch than the rest of 'em. But this method doesn't require changing subnet settings anywhere.

As for your stated question, what you're looking to do is entirely possible. It'll be easier on everything else if you can subnet off the rest of your network so you don't have overlapping subnets, but that firewall may be smart enough to handle the proxy-arps needed to connect the non-firewalled machines to the firewalled ones.

share|improve this answer

Thanks, I got it to work!
The mistake I made was assigning the network IP ( to the router computer.

Here is my working setup:

Router computer has 2 NICs:

  1. = (eth0) on the network /24
  2. = (eth1) on the network /28

The smaller subnet is:

  • subnet =
  • netmask =
  • = network
  • = gateway (eth1)
  • ~ = usable IPs
  • = broadcast
share|improve this answer
Please accept your, i. e. this answer :) – Adrian Heine Oct 17 '12 at 18:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.