1

Hello, I am working on my Network+ certification, and believe I have an understanding now of the binary concept of subnetting, borrowing bits from host for network address, etc, but how do you actually implement it in a real-world environment?

How would I create two subnets on same LAN, (/25 with 126 hosts each)? Presumably the second network would have IP ranges starting with 129-254?

Is this done on the router, or how would this be implemented?

Can modern routers have two gateway addresses for two networks?

If you created two separate networks, such as 192.168.1.0 and 192.168.2.0, its no longer a subnet right? Its now just two class c networks with 254 hosts each. The same would be true if you created a vlan?

If you can just create two networks, what is the point of subnetting?

Can anyone provide a very rough procedure to create a subnet on a home network, and explain how this might differ from the vlan or 2 separate networks above? Thanks for any help, this stuff is very interesting to me and I’m looking forward to learning more as I pursue this path.

16 Spice ups
2

In the “real world” this isn’t done anymore - by that, I mean subnetting.

In the old days, you were given a network. It was a range of public IPs. It was up to you to divide that network in a way that worked for your business.

If I gave you a Class C network and you had four campuses, you’d have to divide those addresses up among those four by creating smaller networks that were all still within the scope of the original network.

It wasn’t often as easy as saying “Just divide by 4!” Maybe one campus had 100 hosts, another 50, another 20, and the last 10. Your job, as network engineer, was to come up with a scheme that allowed that Class C to satisfy all those campuses. That is subnetting.

Today, with all of the RFC1918 private address space and NAT/PAT, no one subnets anymore. Instead, people just pick a prefix a.b.c.0 and add a /24 after it.

You might find a rare instance where subnetting is still used - an ISP connection. Each campus has a /28 block and a /30 block. My IPs are the /28 and the ISP’s router is one of the two IPs in the /30 - my router is the other. Somebody at the ISP had to figure out those address ranges so they don’t overlap and so all the IPs get routed to the right place. But even that’s moving to the RFC1918 address space.

3 Spice ups
3

Welcome to the community!

Here is a real world example of how I am taking a base network of /23 size, and subnetting it into multiple smaller networks so I can isolate the different types of devices and explicitly control the traffic flow through my firewall. All of the subnets have their gateway on my firewall. You will notice that I use all sorts of different sized subnets, depending on how many devices I need in the subnet.

The base network for this location is 192.168.112/23, which encompases 192.168.112.1-192.168.113.254 as usable IP addresses.

Yes, a router could have all of these networks on it. Typically you would have a sub-interface for each subnet.

This is much more complicated than what I would recommend to a beginner. If you can understand it, you are in good shape.

Part of how I got here is that my branches were originally setup with a single /23 network, and I am trying to introduce new subnets while still fitting into that same general address space.

VLAN	Desc		Network ID		Subnet	Mask
100	SERVERS		192.168.112.0		27	255.255.255.224
101	PCs		192.168.113.128	        25	255.255.255.128
102	WIRELESS	192.168.113.64		26	255.255.255.192
132	PRINTERS	192.168.112.32		28	255.255.255.240
148	WAP		192.168.112.48		28	255.255.255.240
164	ACCESS_CONTROL	192.168.112.64		28	255.255.255.240
180	DVR		192.168.112.80		28	255.255.255.240
196	UPS		192.168.112.96		28	255.255.255.240
200	iDRAC		192.168.113.0		27	255.255.255.224
1 Spice up
4

Any communications that is not within the subnet must be routed to be received by a system in another subnet. It’s not so much that the subnets are “created” at any one place but rather that there will have to be routes defined in order to get any two distinct subnets to communicate.

Let’s use your /25 subnet in an example. Let’s say we have a system with an IP address of 192.168.1.25, as you’re probably aware, with a 25-bit subnet mask (255.255.255.128), the first 3 octets of the IP address and the first bit-worth of the last octet specify what network it is on while the remainder specifies the host. A host with this IP address can freely communicate with any other IP address in the range of 192.168.1.1 to 192.168.1.126 (with 192.168.1.0 reserved as the network address and 192.168.1.127 reserved for broadcast). Any communication that a system’s network interface may receive from a system on another another IP subnet will be dropped/ignored as that’s how IP subnets work.

When this same system want’s to communicate with an IP address, say 192.168.1.132, that is not in it’s subnet it will forward that to the specified default gateway (assuming one is specified). In this case, let’s say the default gateway for this subnet is at an IP address of 192.168.1.1. A routing device to which such traffic is directed will have multiple interfaces (either physical or virtual). Upon receiving the IP packet, the router checks the destination IP address against it’s routing table and sees if there are any subnets that correspond to the destination IP address. If so, it will use the interface associated with an IP on that subnet to send the packet along to so that it can be received accordingly. Otherwise, that router will pass it along to any default gateway defined for it so that that routing device can go though the same process. If there is no default gateway defined, the packet is just dropped.

If you created two separate networks, such as 192.168.1.0 and 192.168.2.0, its no longer a subnet right? Its now just two class c networks with 254 hosts each. The same would be true if you created a vlan? If you can just create two networks, what is the point of subnetting?

Can anyone provide a very rough procedure to create a subnet on a home network, and explain how this might differ from the vlan or 2 separate networks above? Thanks for any help, this stuff is very interesting to me and I’m looking forward to learning more as I pursue this path.

No, 192.168.1.0 and 192.168.2.0 (assuming a 24-bit subnet mask) are still two different subnets. Don’t get confused by old classful networking terminology. It used to be that there was a very strict correspondence between an IP address and a subnet mask such that the first few bits of the former determined the latter (and also tended to lead to a lot of wasted address space in the process). The segments of IP address space that was set aside for private use also corresponded to these old classful networks. This is part of why you’ll hear people refer to addresses starting with “192.168.” as a “Class C” network address and, by doing so, will therefore imply that the subnet mask they are using is 24 bits (255.255.255.0).

Nowadays there is really no need for such classful distinctions outside of being shorthand for subnet masks; a subnet is a subnet is a subnet. There are no predefined “networks”, just predefined segments of the IP address space defined for private use that only allow for a certain range of subnet masks to be used so as not to overlap with other address space. You could readily set up a create a 172.16.0.0/15 subnet and still be within that range of private address space.

Also, don’t confuse subnets with VLANs. While they usually have a one-to-one association, they are handled at two completely different layers. VLANs allow you to virtually segment a network on Layer 2 (the Ethernet frame layer) such that network frame broadcast traffic in one VLAN will not cross over to another VLAN rather than having to physically segment them instead and have additional hardware in the process. It’s only because, when routing a packet between subnets, a routing device may encapsulate a routed IP packet in a network frame that is tagged for a certain VLAN that there is any association between VLAN IDs and subnets.

1 Spice up
5

Really great explanations! Thanks. I guess im wondering, in the /25 example, a host with 192.168.1.25 and subnet 255.255.255.128, does the router have to be configured to allow the host to use this subnet? By giving the router this subnet mask, does it automatically separate traffic into two subnets, on which hosts that I assign the appropriate mask would then communicate? I guess Im wondering what best practice would be to take a small home network or business network with one gateway, and split it in two. The general procedure or process (irrespective of the obvious differences in vendors and hardware) is what Im looking to learn.

Is a Vlan (if supported) the best way?

In the example since these are vlans, can’t they be arbitrarily assigned any IP address you want on a private network? You could have your primary network of 192.168.1.0 with 254 addresses, and a vlan of 171.60.80.0 as well? Is the correlation between the addresses (if the vlan was 192.168.2.0) purely for organizational sake?

Thanks!!

6

You would generally give the router an IP address in each subnet, actually, you would generally do this at a Layer3 switch level and have trunk port to the router, but that’s bye the bye.

For the router to route between the two subnets, it needs an address in each subnet to talk on.

I would generally have a separate VLAN for each subnet,

There is no standard correlation between vlan’s and subnets, you can assign any private address range to any vlan number you want, so yes you could have vlan1 being 192.168.1.0/24 and vlan2 being 172.16.31.1/16 and vlan3 as 10.10.10.0/24 etc etc (171.60.80.0 would be a public IP range, so wouldn’t recommend that for internal use)

1 Spice up
7

If you have a network with 192.168.1.0/24 and 192.168.2.0/24 in order to communicate them you need a router / gateway or layer3 switch.

In real world, for network isolation is prefered to use VLANS

For example, a common scenario is to have several subnets in a company to isolate traffic from servers, voice/ip (phones), workstations, wifi, etc.

VLAN 101 data

VLAN 102 servers

VLAN 103 workstations

VLAN 104 Wifi

VLAN 105 Wifi Visitors

VLAN 106 Audio/Video

VLAN 107 AV Data

VLAN 108 Voice

etc

Then you assign a VLAN to ports in the switch

1 Spice up
8

So now going about setting that up,

A: use a virtual setup and test with a virtual router

Virtualbox & OPSense
Really cool new features like mdns repeaters… very cool

allowing use of things like Chromecast to be on their own IOT Subnet but allowing other subnets access to them… very nifty…

play with that and see what you can do… the rabbit hole there is pretty cool…

B: What router are you using and playing with?

do you have a managed switch around to play with… .something like an 5-8 port tough switch from ubiquiti is helpful

If a SoHo - is it the router for your normal internet / House / Apt / Dorm whatever…

are you able to spend $150 to replace it when you brick it when you mess up?

what will you do for internet if you make a mistake?

Backup Plan?

Modern Router - Yes Supported
However that isn’t a Modern Home Router
a “Modern” router is a Layer 3 Switch generally.
Layer 2 Switch - Know the Difference! will not route but will pass Tagged Traffic and tag it in and out.

Modern SoHo router - not generally supported - Linksys / netgear not really…

they create Guest networks which is really just an ACL to block access to any IP beyond just the gateway.

splitting a 24 isn’t as commong

more common is huge subnets/vlans more /16 giving ~65k address and then using 3rd octet for organization of statics within the range…

…

Home setups - have to use something like DD-WRT / Tomato firmware to get better usage VLANS & routiung within the device - really opens up the router…

that is both good and bad depending on your level of understanding of what you’re doing!

…

network+ typically doesn’t jump into the 255.255.255.128 networks splits does it?
Remember A+ wouldn’t touch that as a 128 broke rules that only Cisco allowed the use of. (a ways back)
something about a borrowed bit in calculation for it, however its common-ish now.

in CIDR
192.168.1.0/25
192.168.1.128/25

…

9

Using VLANs, you could even use the same subnet for every one, so long as they weren’t interconnected. But you wouldn’t, because of the obvious issue of there being duplicate addresses, and a future boss that requests the VLANs be opened up to talk to each other. For that same reason, you would only use private addresses for each one (171.x.x.x is OUT) for the same reason.

Think of subnets as TV or CB channels. With the right selections, you can talk to each other. So, on a 192.168.1.0/24, everyone with that address can talk to each other. But not to someone on the 192.168.2.0/24 channel, without a router/L3 switch. Those same networks on a /23 CAN talk to each other without a router, but couldn’t talk to the 192.168.3.0 network.

1 Spice up
10

A router doesn’t define the traffic on a network segment. Each device is responsible for its own knowledge of its IP address, it’s correct subnet mask (and from those two calculating the network ID, broadcast ID, and what is a local and remote network), and for knowing where to route traffic if a destination address is remote. It is very possible for the router to disagree with other devices as to what the subnet mask should be for a subnet, or even as to what the network ID is.

For example, say the router has ip address of 192.168.10.1/25. A PC on the same physical ethernet subnet has an address of 192.168.10.10/24. The PC and the router will have no problems talking to each other, because they’re both on the same ethernet network and they correctly know that they are part of the same subnet. What gets tricky is if the PC at 192.168.10.10 needs to talk to a printer at 192.168.10.200/23. The way the network is implemented, 192.168.10.200 is on a different subnet. Let’s say they’re on different VLANs. The correct traffic flow would be the PC sending traffic to the router, which would then forward traffic to another interface on the way to the printer. Return traffic from the printer would go to it’s gateway, which would then forward back to the PC. The PC, however, believes that the printer is local, because it should be according to the subnet mask that the PC has. The PC will never send printer bound traffic to the router, so it will never get to the printer. In fact, it would fail on ARP. Traffic wouldn’t flow, because the PC has the wrong mask.

2 Spice ups
11

Here’s my two cents to help clarify things:

Just in case: it looks like you may be thinking of a “LAN” as being a “/24 network with 254 available hosts.” That’s typically the case, but not necessarily so: it’s just a convention, not a definition. You can create any kind of subnet(s) you want on your Local Area Network (LAN) — just be sure to use private address space. The typical /24 network is a subnet — just a particular kind.

If you wanted two subnets falling in your example IP range, then they would typically be 192.168.0.0/25 and 192.168.0.128/25. And you’re correct: the second subnet would have usable IPs 129-254.

To flesh this out a bit, if you don’t need both subnets using adjacent IPs, then you can use any ranges you like (eg 10.0.50.0/25 and 192.168.30.0/25 … whatever). Also, you can have subnets of different sizes depending on what you need. You can play with this using a subnet calculator like Spiceworks’ one at Free Tools for IT Pros & SysAdmins - Spiceworks which is a really nice way to visualize what’s going on.

Is this done on the router, or how would this be implemented?

Yes, the router needs to handle the network traffic. As stated in other posts, each subnet would need a gateway to connect to other subnets.

You would configure your router to have two IPs — one on each subnet. These will act as the gateway addresses. If the router also does DHCP, then each device will of course ‘learn’ the network settings from the router and fall into the subnet properly.

Alternatively, a Layer 3 switch can also do this, basically acting as a router (typically without providing DHCP itself though). But as you have sniffed out, there’s more …

Can modern routers have two gateway addresses for two networks?

It depends on your router. If it has a built-in switch that allows you to assign a subnet to each Ethernet port, then whatever you plug into that port will be exclusively on that unique subnet: devices will know where they are (especially if DHCP’d) and talk to that one gateway address (of the two).

Other routers that don’t allow that may allow VLANs which is a way of running multiple subnets over the same physical network/hardware. In that case, the devices will need to be configured to listen to a particular VLAN and/or be configured with the desired subnet information.

Think in terms of each device needing to know a) it’s own IP address, b) the subnet it’s on (which it will know based on its own IP combined with the subnet mask) and c) the gateway. If you’re clear on those parameters, then it will all fall together for you. All these network interfaces are just doing what they’re told so you have to be clear on what to tell them.

If you created two separate networks, such as 192.168.1.0 and 192.168.2.0, its no longer a subnet right? Its now just two class c networks with 254 hosts each. The same would be true if you created a vlan?

If you can just create two networks, what is the point of subnetting?

Actually, those are two subnets. Subnets are just networks within networks — pieces of networks.

It actually helps to be a bit anal here. A class C network is a /24 subnet that falls within specific IP space (192-233.x.x.x — itself a subnet of a bigger network) that is reserved for private use and not routed on the internet. Think in terms of subnets because the subnet is what it really is. Subnets can be nested and can come in different sizes: /24 is the most common. But as long as you’re in Class C address space, any size or any number of them are fine for a LAN. Physical LANs or VLANs are both comprised of subnet(s).

Can anyone provide a very rough procedure to create a subnet on a home network, and explain how this might differ from the vlan or 2 separate networks above? Thanks for any help, this stuff is very interesting to me and I’m looking forward to learning more as I pursue this path.

I think what I’m hearing is you want to create a dedicated network off your existing home router to practice what you’re learning on your Network+ certification. That depends on what your router feature set is. Look for VLAN features or the ability to assign subnets to Ethernet ports as mentioned above. A typical home router will not have these.

As others have cautioned, you don’t want to brick your home router. Consider picking up a more capable unit and putting it behind your home router to create the separate network you want for your training. If money’s an issue, look for an old SnapGear (metal case only — they have the assignable switch) on eBay and play to your heart’s content :slight_smile:

All the best!

12

Here ya go…

Just to Muddy it up a bit!!!

FUD-Router.jpg
FUD-Router.jpg800×446 52.8 KB
13

Annnnnd, this is why I love Spiceworks. Thanks everyone, the picture is becoming more clear.