Skip to main content
deleted 5 characters in body
Source Link
Zac67
  • 88.1k
  • 4
  • 73
  • 137

This is called an "overlay network" and can be surprisingly useful, in specific setups.

  • PC1/2 can talk to each other, and PC3/4 can talk to each other.
  • SW1 and 2 see ARP requests forframes from all 4 hosts and build their MAC tables with all four hosts (ethernet being layer 2)
  • All 4 PCs see ARP requests but disregard the opposite two because they're from outside the local /24 network.

There is limited Security offered here - any PC can sniff the wire and potentially see traffic that is from the opposite hosts. Also, any PC can simply give itself a secondary IP in the other network and can then participate.

As pictured, your network hosts have no default gateway, so won't be able to see anything else outside this limited network. No Address allocation like DHCP or similar, so you're trusting each host will have it's IP hard set correctly.


Why would you want a setup like this?

Imagine a site that doesn't have a managed switch, only has a single unmanaged switch. By running an overlay network you can have two "separate" networks, perhaps one for storage with no gateway, and a LAN for regular use. Yes this is a somewhat contrived example.

An extension that I've seen in real life is to have a subnet inside a supernet, a /28 at the very front of a /24.

  • Some contractors had hard-set IPs in the first 14 addresses, with /29
  • DHCP was used for other hosts on site
  • The site's router had the xxx.1/24 IP so it was in both subnets and worked fine for both.

Result, the contractors could not see or get to any other host in the lan, and could still get out to the internet.

This is called an "overlay network" and can be surprisingly useful, in specific setups.

  • PC1/2 can talk to each other, and PC3/4 can talk to each other.
  • SW1 and 2 see ARP requests for all 4 hosts and build their MAC tables with all four hosts (ethernet being layer 2)
  • All 4 PCs see ARP requests but disregard the opposite two because they're from outside the local /24 network.

There is limited Security offered here - any PC can sniff the wire and potentially see traffic that is from the opposite hosts. Also, any PC can simply give itself a secondary IP in the other network and can then participate.

As pictured, your network hosts have no default gateway, so won't be able to see anything else outside this limited network. No Address allocation like DHCP or similar, so you're trusting each host will have it's IP hard set correctly.


Why would you want a setup like this?

Imagine a site that doesn't have a managed switch, only has a single unmanaged switch. By running an overlay network you can have two "separate" networks, perhaps one for storage with no gateway, and a LAN for regular use. Yes this is a somewhat contrived example.

An extension that I've seen in real life is to have a subnet inside a supernet, a /28 at the very front of a /24.

  • Some contractors had hard-set IPs in the first 14 addresses, with /29
  • DHCP was used for other hosts on site
  • The site's router had the xxx.1/24 IP so it was in both subnets and worked fine for both.

Result, the contractors could not see or get to any other host in the lan, and could still get out to the internet.

This is called an "overlay network" and can be surprisingly useful, in specific setups.

  • PC1/2 can talk to each other, and PC3/4 can talk to each other.
  • SW1 and 2 see frames from all 4 hosts and build their MAC tables with all four hosts (ethernet being layer 2)
  • All 4 PCs see ARP requests but disregard the opposite two because they're from outside the local /24 network.

There is limited Security offered here - any PC can sniff the wire and potentially see traffic that is from the opposite hosts. Also, any PC can simply give itself a secondary IP in the other network and can then participate.

As pictured, your network hosts have no default gateway, so won't be able to see anything else outside this limited network. No Address allocation like DHCP or similar, so you're trusting each host will have it's IP hard set correctly.


Why would you want a setup like this?

Imagine a site that doesn't have a managed switch, only has a single unmanaged switch. By running an overlay network you can have two "separate" networks, perhaps one for storage with no gateway, and a LAN for regular use. Yes this is a somewhat contrived example.

An extension that I've seen in real life is to have a subnet inside a supernet, a /28 at the very front of a /24.

  • Some contractors had hard-set IPs in the first 14 addresses, with /29
  • DHCP was used for other hosts on site
  • The site's router had the xxx.1/24 IP so it was in both subnets and worked fine for both.

Result, the contractors could not see or get to any other host in the lan, and could still get out to the internet.

Source Link
Criggie
  • 737
  • 5
  • 13

This is called an "overlay network" and can be surprisingly useful, in specific setups.

  • PC1/2 can talk to each other, and PC3/4 can talk to each other.
  • SW1 and 2 see ARP requests for all 4 hosts and build their MAC tables with all four hosts (ethernet being layer 2)
  • All 4 PCs see ARP requests but disregard the opposite two because they're from outside the local /24 network.

There is limited Security offered here - any PC can sniff the wire and potentially see traffic that is from the opposite hosts. Also, any PC can simply give itself a secondary IP in the other network and can then participate.

As pictured, your network hosts have no default gateway, so won't be able to see anything else outside this limited network. No Address allocation like DHCP or similar, so you're trusting each host will have it's IP hard set correctly.


Why would you want a setup like this?

Imagine a site that doesn't have a managed switch, only has a single unmanaged switch. By running an overlay network you can have two "separate" networks, perhaps one for storage with no gateway, and a LAN for regular use. Yes this is a somewhat contrived example.

An extension that I've seen in real life is to have a subnet inside a supernet, a /28 at the very front of a /24.

  • Some contractors had hard-set IPs in the first 14 addresses, with /29
  • DHCP was used for other hosts on site
  • The site's router had the xxx.1/24 IP so it was in both subnets and worked fine for both.

Result, the contractors could not see or get to any other host in the lan, and could still get out to the internet.