Apologies in advance for the botched terminology. I have read the Server Fault Subnet Wiki but this is more of an ISP question.

I currently have a /27 block of public IPs. I use give my router the first address in this pool and then use 1-to-1 NAT for all the servers behind the firewall, so that they each get their own public IP.

The router/firewall is currently using (actual addresses removed to protect the guilty):

IP Address:  XXX.XXX.XXX.164
Subnet mask:
Gateway:     XXX.XXX.XXX.161

What I would like to do is break out my subnet into two separate /28 subnets. And do this in a way that is transparent to the ISP (i.e., they see me as continuing to operate a single /27).

Currently, my topology looks like:

  [Managed Ethernet Switch]
  /       \         \
[Server1] [Server2] [Server3] (etc)

Instead, I would like it to look like:

    /      \
[Router1] [Router2]
  |    |    |   |
[S1] [S2] [S3] [S4] (etc)

As you can see, this would partition me into two separate networks.

I'm struggling with what the correct IP settings would be on Router1 and Router2.

Here's what I have right now:

              Router1              Router2
IP Address:   XXX.XXX.XXX.164      XXX.XXX.XXX.180
Subnet mask:
Gateway:      XXX.XXX.XXX.161      XXX.XXX.XXX.161

Note that normally you would expect Router2 to have a gateway of .177, but I'm trying to get them both to use the gateway originally given to me by the ISP.

Is subnetting like this in fact possible, or am I completely botching the most basic concepts?



Several people have asked "Why". There are a couple of specific reasons why I want to do this:

  1. My router/firewall locks up every 6-8 weeks. I've gone through a litany of devices: NetGear FVS318, Linksys RV042, Watchguard Firebox Edge X20e, and a Cisco ASA 5505. The same thing has happened with all devices, and it's apparently due to the dozen or so IPSec VPN tunnels that the device manages. Whenever it locks up, a network engineer needs to physically power-cycle the device.

  2. I have one large client and about 1/2 the servers in the cabinet are theirs. I would like that client to be able to manage the firewall and VPN rules themselves instead of going through me. This way, I would give them root access to Router2 and they could manage everything themselves without causing any problems to Router1.

  • 1
    Just out of curiosity what is your motivation for this setup? Why do you need two routers?
    – Zoredache
    May 30, 2010 at 8:57
  • Why is a good question? Maybe to get rid of NAT'ing?
    – dbasnett
    May 30, 2010 at 12:04

7 Answers 7


If you're not using NAT, i.e. if you want to actually do routing and put real servers on those IP address, then you can't subnet your network in a way that is transparent to your provider; they will need to modify their router configuration and their routing tables to account for your new network setup, possibly giving you two gateway addresses and/or two routers (or by setting up a new route if you put one subnet "behind" the other and your firewall in the middle).

Howewer, if you keep using NAT and simply give half of the addresses to a firewall and half of them to another, then their external IPs will appear to your ISP as still belonging to a single subnet, and everything will keep working fine.

  • Why would that be? From the ISP's perspective nothing has changed. x.x.x.160 - .191 are still on the same port. The OP will likely need to have three routers, instead of a switch and two routers, but the ISP won't need to do anything.
    – dbasnett
    May 30, 2010 at 11:36
  • 1
    If the ISP's router, which is the gateway for this subnet, has an IP configuration of XXX.XXX.XXX.161/224, then only hosts on this subnet will be able to talk to it; if you split it into two subnets, one of them will just not be able to talk with the router at all. The router will need two IPs with a /240 subnet mask each in order for everything to work.
    – Massimo
    May 30, 2010 at 11:41
  • I was/am assuming that the connection to the ISP is on a different net than the /27 the OP is talking about since the OP has a Router / Firewall already.
    – dbasnett
    May 30, 2010 at 11:44
  • This ISP RTR x.x.x.157 ----- x.x.x.158 USER RTR x.x.x.160 /27
    – dbasnett
    May 30, 2010 at 11:46
  • or ISP RTR x.x.x.161 ----- x.x.x.162 USER SW x.x.x.163 - 191
    – dbasnett
    May 30, 2010 at 11:48

That all looks perfectly correct. Note that the servers will use the .240 netmask and either .164 or .180 as the gateway. However, are you sure you want to waste two IPs on the subnetting? You have to reserve .160 and .176 as network addresses, and .175 and .191 as broadcast addresses. If you don't subnet, you don't have to do this, so .175 and .176 can be hosts.

        | assumes that this link is not part
        | of x.x.x.160 /27
    [Router]  This router will need three routed ports
   /.161   \ .177
  /         \
 [Switch] [Switch]
  |    |    |   |
[S1] [S2] [S3] [S4] (etc)
  • The link from ISP to router is part of X.X.X.160/27 -- that's the public IP as provided by the ISP.
    – Portman
    May 30, 2010 at 16:41
  • @Portman - I am confused then by this statement in the OP "I use give my router the first address in this pool...". What addresses does the ISP use?
    – dbasnett
    May 31, 2010 at 13:27
  • What do mean by "assumes that this link is not part of x.x.x.160/27"?
    – Draemon
    Jun 24, 2010 at 23:10
  • for the picture to be correct. as you can see that was not correct.
    – dbasnett
    Jun 25, 2010 at 11:57

It won't make any difference to your ISP if you break up that /27 block into smaller blocks, from their perspective, all they know is that they must deliver that /27 block to the external interface of your router.

You will need a router that either has 3 separate interfaces (one WAN, two LAN) or a router that is capable of supporting multiple ranges on it's interfaces.

you can then split the block into two separate blocks x.x.x.160/28 and x.x.x.176/28

in your example though, you had your default gateways wrong. Each of those blocks would have it's own default gateway because each of the new /28 blocks will need to be set up on an interface on the router, and whatever IP is setup on that interface will be the gateway for the rest of the block.


Yes, you should be able to take your c.x.x.160/27 and split it into x.x.x.160/28 and x.x.x.176/28. You MAY have to make your Router2 use Router1 as the next hop, possibly by having a point-to-point link between them and use a /30 out of a private range as the link.

Also, by splitting the /27 into two /28s, you end up with fewer usable IP addresses.

If you can tell us why you want to break it up, it may be that there is another option to accomplish what you want done.


Using a fictitious address ending in .160

Network*          Net Broadcast     CIDR Mask              UsableHosts   28   14          REQ 14   28   14          REQ 14  

*From my Subnet Calculator / Planner

  • .164 with a /28 belongs to .160 /28. I assume you just used that address as being part of the network. In my example you can use addresses between Network and Net Broadcast.
    – dbasnett
    May 30, 2010 at 10:54

Ofc you can do this, you have to make it into /27 that means 30 hosts (plus 2 network and broadcast) your network will be - (i mean hosts) with

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.