I want to create a subnet in our network, where the devices which will be connected in this subnet (e.g. 192.168.20.x) will not have access in the Internet.

However, these devices will be accessible from other subnets (e.g. fro 192.168.0.x)

The router is D-LINK DSR-1000AC and the switch D-LINK DGS-1210

Is it possible to create such a network?

enter image description here

  • Unfortunately, D-Link doesn't offer a paid support option for its products, so they are off-topic here.It should be possible as long as the router support multiple local networks (not all SOHO router does it), using a firewall policy to block traffic from 192.168.20.xxx to the Internet.
    – JFL
    Commented Feb 9, 2018 at 10:38
  • With business-grade hardware this would be very easy (create a VLAN/zone and configure routing/filtering appropriately).
    – Zac67
    Commented Feb 9, 2018 at 12:20

1 Answer 1


In the switch create 3 VLANs:

The first one, let's call it VLAN A for all the devices in range 192.168.20.xxx.

The second one VLAN B for the devices in 192.168.0.xxx.

And a third one for example VLAN C for the router.

Keep in mind that you must change the IP address of the router to make it belong to another subnet: 192.168.10.XXXfor example.

It means also that the router will be unable to act as DHCP server and the devices on the other two VLANs must get their IP addresses from other DHCP server on their respective VLANs or be configured manually.

In the switch there is a feature called static routing that you can use to create routes between VLANs.

  1. Create an static route from VLAN A to VLAN B.

  2. Another static route from VLAN B to VLAN C.

In that way VLAN A can communicate to VLAN B, but will be unable to reach VLAN C.

Not the answer you're looking for? Browse other questions tagged or ask your own question.