Dividing a network into subnets using a router

Question

I am learning about how L3 and IPv4 addressing works and I need some clarity on certain things.

I've encountered the following topology

So in this topology, the router stands in the center and divides the network into two separate sub-networks, right? We separate networks like this when we don't want certain devices to talk to each other and when we want to reduce unnecessary network traffic and congestion and improve security.

Is the router necessary to divide the network like this? What if we removed the router but kept the IP addressing?

Answer 1

the router stands in the center and divides the network into two separate sub-networks, right?

Actually, the router connects the subnets that are divided by their different subnet prefixes and by separate L2 segments.

We separate networks like this when we don't want certain devices to talk to each other and when we want to reduce unnecessary network traffic and congestion and improve security.

Separating subnets & L2 segments and connecting them by router doesn't have any significant impact on congestion and security by itself. While it reduces (splits) the broadcast domain, anything else requires additional measures. Forcing inter-subnet communication through a router allows you to control traffic on that exact point - by ACLs, firewall functions, or any other filter.

Is the router necessary to divide the network like this?

Not for dividing them, no. It is required for connecting them.

What if we removed the router but kept the IP addressing?

In your diagram you've replaced the router by a bridged link. While that joins the L2 segments into a single one, the IP subnets are still distinct and - without a router - without connectivity.

As you've already pointed out, you could manipulate the local routing tables to enable connectivity (force the other subnet to be on-link). Similarly, you could also shorten the network mask/prefix length to /22 or shorter (supernetting).

Answer 2

What if we removed the router but kept the IP addressing?

PCs 1 and 2 would not be able to talk to 3 and 4.

PC 1 would determine that PC 3 is not on the same subnet, so it would normally forward the packet to a gateway to be routed. But in the second diagram, there is no gateway, so PC 1 would simply return an error to the application saying there is no route to the host.

We separate networks like this when we don't want certain devices to talk to each other and when we want to reduce unnecessary network traffic and congestion and improve security.

That's usually not the real reasons. The purpose of routing is to deal with the scale of large numbers of devices spread over large areas. The first computer networks were small enough that they didn't use routing.

Answer 3

We separate networks like this when we don't want certain devices to talk to each other and when we want to reduce unnecessary network traffic and congestion and improve security.

We split up Ethernet networks for several reasons.

One is to control broadcast traffic. Particularly embedded devices may struggle if the broadcast traffic rises too high.

Another is that Ethernet requires a loop-free topology, that is fine in a small network, but as the network gets larger it gets more and more inefficient.

Another is security, while it is possible to do filtering on layer 2 Ethernet traffic, it's generally easier and more convenient to do it on an IP device. It's also easier to prevent/mitigate issues like one device hijacking traffic intended for another.

Is the router necessary to divide the network like this?

There are two distinct but related concepts.

The first is the Layer 2 domain. That is the group of devices that can send Ethernet* packets to each other directly over a physical or virtual Ethernet network.

The second is the IP subnet, this defines what hosts the IP stack will assume are "on link" by default and send IP packets to directly, rather than trying to send them to a router.

Most of the time we keep a 1:1 mapping between Layer 2 domains and IP subnets. That is not to say there are never reasons to put multiple IP subnets on the same Layer 2 domain or to split a subnet between Layer 2 domains, but it's something that should be carefully considered before proceeding.

What if we removed the router but kept the IP addressing?

Then by default, if the IP stack is behaving in the expected manner, the hosts should be unable to exchange IPv4 unicast traffic.

Note that this is NOT the same thing as saying they would be unable to exchange traffic at all. IPv6, IPX, Netbeui etc are all completely independent of the IPv4 addresses you set. IPv4 broadcast and multicast traffic may also pass between the hosts.

You could make specific hosts able to exchange IPv4 unicast packets, by adding explicit entries to their routing tables to mark the other hosts as on-link and/or adding secondary IP addresses. You could also deploy a "one-armed router", which routes between multiple subnets on the same L2 link layer.

Having multiple subnets on one link and trying to restrict traffic between them is likely to lead to a false sense of security. You test with your ipv4 unicast pings and everything seems to be in order, but then either a malicious actor gets sufficient privileges to reconfigure the network stack on one of the hosts, or they discover can perform their malicious actions over a protocol other than IPv4 unicast.

* In theory other multipoint link layers exist, in practice in the real world it's very rare to see anything other than Ethernet or Wi-Fi which are similar enough for these purposes.

Answer 4

Actually turning my comment into an answer.

Without a router, with appropriate configuration, you could still have all these machine talking together. Note, this is valid with relatively "smart" hosts, it's not necessarily doable with just any device.

Your router, in your initial diagram, has been configured and knows "who is where". Your computers on each of the 2 subnets know how to talk to others on the same subnet, and in general they'd have a setting saying "if not on your subnet, send to router" (typically, your "default route").

In the 2nd diagram, PC1 & PC2 could be configured (as in configuring their routing table) with an entry in their routing table saying "to talk to 192.168.2.x, just talk on the network"). PC3 & PC4 would have similar setting for 192.168.1.x.

It's arguable as to why you'd want to do this, but it is doable. Machines in one subnet can talk to another subnet on the same physical network without a router.

Also note, as I stated before, with a router, PC1 can talk to PC3 ONLY with appropriate configuration. Sticking a router between 2 subnets does not magically make this happen. You may already know about this, if you don't, the main "magic" is called "DHCP", consider looking it up. That's how in the vast majority of cases, when you connect a computer to a network, it gets its configuration.

Answer 5

This is called an "overlay network" and can be surprisingly useful, in specific setups.

• PC1/2 can talk to each other, and PC3/4 can talk to each other.
• SW1 and 2 see frames from all 4 hosts and build their MAC tables with all four hosts (ethernet being layer 2)
• All 4 PCs see ARP requests but disregard the opposite two because they're from outside the local /24 network.

There is limited Security offered here - any PC can sniff the wire and potentially see traffic that is from the opposite hosts. Also, any PC can simply give itself a secondary IP in the other network and can then participate.

As pictured, your network hosts have no default gateway, so won't be able to see anything else outside this limited network. No Address allocation like DHCP or similar, so you're trusting each host will have it's IP hard set correctly.

---

Why would you want a setup like this?

Imagine a site that doesn't have a managed switch, only has a single unmanaged switch. By running an overlay network you can have two "separate" networks, perhaps one for storage with no gateway, and a LAN for regular use. Yes this is a somewhat contrived example.

An extension that I've seen in real life is to have a subnet inside a supernet, a /28 at the very front of a /24.

• Some contractors had hard-set IPs in the first 14 addresses, with /29
• DHCP was used for other hosts on site
• The site's router had the xxx.1/24 IP so it was in both subnets and worked fine for both.

Result, the contractors could not see or get to any other host in the lan, and could still get out to the internet.