1 IP, 1 Router(Linksys 4-port): How to split network into two subnets that cannot see each other.

Posted on 2004-10-04
Medium Priority
Last Modified: 2013-11-29
I've been in a quandry to complete this networking task, but have gotten confused on how to create a subnet on an existing network. Resources available include a single IP 4-port router servng off of a T1 modem.  Beind the router, one port goes off to one department, while another router port goes off to another department; each has their own hub systems serving their machines.

We are currently using local IP (device IP) and (subnet mask).  Neither department is supposed to see or access each other.  Unfortunately, both are currently being blinded from each other only by means of protocol settings, but, periodically the protocols are reset and each department can see each other until the protocols are reset.  I need to stop this.  First, the protocol method does not create any real security (obviously), and secondly, because these settings prevent either side from using the networks workgroup and sharing features adequitely.  

First method: I have thought of using a hub to split the T1 feed then run two routers off the hub, each with their own global IP (I'd get a second IP from our ISP), then each department could keep their current local IP configuration without my needing to change anything.  

Second method: I have also thought of trying to set up a subnet, but I can't quite figure out how to resolve the breakdown of how to reconfigure the subnet masks or how to confirm what local IP sets would be available.  The existing router already has a menu for choosing 2, 4, and 6 subnet masks, but then I don't know what IPs would be available.  I am also concerned that a subnet would not create the separation of the departments that I need.

Well, that's my quandry. I am looking for input as to the doability of my first method, or some direction for accomplishing the second method. No splitsies on this one.  Best response get all the points.

Also, please, I am not a technician, so try not to use too much techspeak.  You may give a great answer, but if I cannot decipher your remarks then it does me no good.

Thank you.
Question by:primeradmin
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +4

Expert Comment

ID: 12220326
Does your router have VLAN ability?  This give the router to act as two seperate lans and not allow data to be passed between the two.

Unless I am having a brain-fart this will be hard to do unless you purchase a second router and do something like the following

T1 with  WAN public address and LAN private address (

Department #1
Router #1 WAN address, mask, gateway
                  LAN address, mask
Router #1 LAN devices connect via hub. 192.168.10.x subnet with gateway

Department #2
Router #2 WAN address, mask, gateway
                  LAN address, mask
Router #2 LAN devices connect via hub. 192.168.20.x subnet with gateway
LVL 79

Accepted Solution

lrmoore earned 1000 total points
ID: 12220710
As plain English as I can get:
you cannot do it with the hardware that you have.

Your first method is your most viable alternative.

Another alternative is to swap the Linksys for a Cisco router, and add a switch to the inside. Create VLAN's on the switch, sub-interfaces on the router, and apply access-lists to the sub-interfaces

Another alternative would be to use a multi-interface firewall where traffic flows from internal interfaces out, but not to each other.

LVL 12

Expert Comment

ID: 12220952
Isn't is possible if you setup your router as - subnet ... NO DHCP.

LAN1 - Hard code all machines to IPs in 192.168.10.x - subnet - Gateway

LAN1 - Hard code all machines to IPs in 192.168.20.x - subnet - Gateway

All machine should be able to talk to and transfer internet traffic, but should only be able to talk to .10.x or .20.x but not eachother.. (make sense?)

You may have to setup static routes in the linksys to get the traffic to pass from 1.1 to 10.x or 20.x
Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

LVL 79

Expert Comment

ID: 12221156
Your option will not work. Your default gateway must be on the same subnet as your interface. The router may see the PC as being on the same local network, but the PC won't know how to get to the gateway.

>LAN1 - Hard code all machines to IPs in 192.168.10.x - subnet - Gateway
                                                                         ^^                           ^^^                             ^^
LVL 12

Expert Comment

ID: 12221342
Ummm.. tested... and it works.
LVL 79

Expert Comment

ID: 12221502
Well, I'm certainly never too old to learn a new trick....

It does not appear to work if doing it at the command prompt (on XP) as demonstrated here:
Windows IP Configuration
Ethernet adapter Local Area Connection:
        Connection-specific DNS Suffix  . : xxx.com
        IP Address. . . . . . . . . . . . :
        Subnet Mask . . . . . . . . . . . :
        Default Gateway . . . . . . . . . :

C:\WINDOWS>route add mask
The route addition failed: Either the interface index is wrong or the gateway does not lie
 on the same network as the interface. Check the IP Address Table for the machine.

However, using the GUI for TCP/IP properties, I can set the gateway to anything outside my local network...
LVL 11

Expert Comment

ID: 12221560
> Ummm.. tested... and it works.

Then not adequately tested.  Although you've given the subnets different subranges, they're not really on different networks.  A sniffer will reveal some of the other subnet's traffic (especially broadcasts, but possibly other stuff as well), and the fact that users can reach the same gateway address means they can actually reach each other's machines as well.

(A hub will not work with a T1.  Don't even go there.)

> you cannot do it with the hardware that you have.

I concur.  The four ports on the router are switch ports on a single VLAN/subnet, and do not offer the kind of separation needed.


Assisted Solution

holger12345 earned 1000 total points
ID: 12221954
lmoore should have been right:
If you mix different subnet types like and it shouldn't work. In fact it works sometimes - but it is unpredictable!
As an ISP you could use this as a feature called supernetting and you use it as a routing option - but you never tell different machines on the same LAN to be in mix-type networks.
Even if it may work it isn't right... that means not reliable.

Second thought - you want to break possible connections... so you should't use an unreliable TCP/IP-protocol (an possibly MicroSoft specific) failure (MS called feature) that you have no control of!

You can try a solution I offered at another ee-question:
LAN1 ---Router1
             LAN3 --- Router3 --- Internet
LAN2 ---Router2

Create an intermediate LAN (LAN3) and NAT both of your LANs to it... route that LAN3 to the internet... is that too simple?

i.e. use for LAN1 ("/24" means "subnet is")
use for LAN2
use for LAN3
You can use two NATing cheap routers to separate each other and using a third cheap router to lead the packets to the internet.
If you use such a router for every departement you're ready

Hope that helps
LVL 12

Expert Comment

ID: 12222675
I simple switch that supports VLAN (from either Cisco or 3com) between the 2 networks and the router would easily solve your problem.

Assign each network a different VLAN and tada!  They can't see or hear each other =) No special configurations on each desktop no special router configs....saves LOADS of headache later on when something doesn't work

Expert Comment

ID: 12226983
aindelicato, sometimes microsoft will allow you to route across subnets incorrectly however according to ip subnet standards you should not be able to communicate with a gateway that is not on the same subnet as the device. ie gateway

holger12345, isn't that the same thing I suggested?


Author Comment

ID: 12282623
I am currently investigating/testing some of the responses posted above.  I'll be back to respond soon.

Expert Comment

ID: 12676891
I think primeradmin wanted to give us the result of his testings... else all should work fine, no?

Featured Post

Video: Liquid Web Managed WordPress Comparisons

If you run run a WordPress, you understand the potential headaches you may face when updating your plugins and themes. Do you choose to update on the fly and risk taking down your site; or do you set up a staging, keep it in sync with your live site and use that to test updates?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question