In the diagram below, I'd like to carve out a /28 network from and move it to another geographical location and still maintain access in and out of the original /24 network.

Essentially there would be a dead address space between and as that would be a new network that's connected to the gateway router. I'm open to any suggestion on how to accomplish this, and if NAT would potentially break certain protocols, then I'd like to stay away from that.

enter image description here

  • I don't see what this has to do with the so-call duplicate, there is no mention of NAT in the question and no need for NAT to solve this problem. May 30 '19 at 11:42
  • @PeterGreen, the original question (deleted, then asked here), says, "Would it be possible to carve out a small subnet, say on the network and then use NAT on the routers to point clients to the server(s)?" The request in both questions was to add the server, at its old address to a different network, but a device connected to a network must have an address in the network to which it is connected.
    – Ron Maupin
    May 30 '19 at 11:52
  • 2
    Is this something that can be accomplished - there are many things that can be done, and in this case it is possible. However, the more important question is often should this be done? In this case, the answer is no. Any way that enables this type of configuration is asking for larger problems to affect the entire network.
    – YLearn
    May 30 '19 at 16:12
  • @PeterGreen I don't necessarily need to use NAT, and I only suggested NAT as I didn't know any other way of solving this issue. I'm certainly open to any suggestions, and if NAT would potentially break other protocols then I'd have to use something else anyway. You mention that NAT isn't needed to solve this issue, how can I solve it without using NAT?
    – Cragmuer
    May 30 '19 at 17:28
  • Using the method that he explained requires a custom routing configuration be put on every host (off-topic here) on the network and the use of secondary addressing on the new network, along with routing changes to the routers. This is probably something you do not want to attempt yourself because you had to ask the question. It will also mean that the custom host configuration will need to be configured on every host later added to the network. You should heed the last sentence is YLearn's comment.
    – Ron Maupin
    May 30 '19 at 17:50

Yes it can be acomplished.

Most of the setup will be the same as for any other new network. You would add the new network as a second network on the router interface facing the network, then make sure all your routers have routes to it (either by static routes or by some routing protocol). Routers use a longest prefix match, so routers with a route to the new network will route packets to it in preference to the old one.

However there is one detail that needs to be attended to. When hosts on the old network try to send packets to hosts on they will by default arp for the destination address rather than the gateway address. In a default configuration this will result in a failure to deliver the packets.

To resolve this we have two options.

  1. Add a static route on the hosts in the old network to send the traffic to the router.
  2. Configure the router facing the network to "proxy arp" for the IPs in question.

You cannot have overlapping networks. Network addressing for a network must be contiguous. If you use part of a parent network, then the parent network no longer exists, only the subnets you have created from the parent network.

If you try to use part of a network somewhere else as you have described, hosts on the original network cannot access the part you have moved. The way a host uses a gateway (router) is that all packets are encapsulated frames and delivered on the local network. A host will mask the destination address on a packet with its mask and compare that to its own masked address to see if they are on the same network. If they are, it will use ARP to get the destination MAC address, but the host on the remote network will never respond, so the packet will be dropped. If the destination IP address is on a different network, the host will use ARP to get the gateway address and encapsulate the packet in a frame destined for its gateway. The router will get it and look up how to reach the destination network. If the address is in the source network, which will be the network from where the packet originated.

Also, devices addressed in one network ( cannot connect to a different network ( unless the addresses are changed to the new network. For example, when a device addressed in the old network is attached to the new network, it cannot communicate with other devices on the new network, including the gateway of the new network, because it will need to send traffic to its configured gateway, which must be in the same network (old) as it, but the gateway is in the new network. It would require a gateway to reach the gateway, and you cannot do that.

You would need to create a completely separate new network, not add to an existing network.

What you propose cannot work.

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Ron Maupin
    May 31 '19 at 17:31

What you're trying to do has serious implications. As Peter's pointed out it's possible with some workarounds but those are not easy to handle. Overlapping networks and proxy ARP become major pains over time as Ron's pointed out.

I'd propose a more sensible approach: use another subnet. Private IP addresses are free to use and you can easily just define a new subnet, set up the routes and you're done. If you really need the /28 subnet's hosts to map into the /24 net you could use destination NAT. NAT is generally ugly but not as bad as fiddling with proxy ARP and split route metrics.

[edit] Since all else fails, you should consider using virtual addresses instead of the unchangeable, local addresses. So, instead of other hosts connecting to through directly, they'd connect to e.g. through

A NAT router in front of the destination subnet takes care of translating those virtual addresses to the actual device addresses. That way you could also move those devices around at will, just changing their virtual address on the NAT router to something you can route.

  • What if you can't change the IP address on the host that needs to be moved? That's the main issue I'm facing, and I've exhausted all possibilities in trying to change those addresses to something else. I need to physically move a device (server) from one location to the other while keeping the existing IP address.
    – Cragmuer
    May 30 '19 at 0:22
  • @Cragmuer: Why exactly "can't change the IP address" ? (see answer below...) May 31 '19 at 20:01
  • @Cragmuer Then you should consider moving the IP subnet with it and renumber the remaining hosts.
    – Zac67
    May 31 '19 at 20:14
  • Unfortunately the software running on the device is so old and horribly designed that the IP address cannot be changed without reinstalling it. It can't be reinstalled because the vendor no longer supports that software. It cannot be upgraded as there is no upgraded version to move to. I've really exhausted any and all possibilities trying to change the IP address in a test environment and nothing works.
    – Cragmuer
    May 31 '19 at 20:44
  • @Cragmuer I mean, move the entire IP subnet along with the device. Then, change the old subnet to another network address.
    – Zac67
    May 31 '19 at 20:47

without changing the IP address

Why exactly ?

If the reason happens to be because of some (legacy?) software package that has its licensing bound to an IP address (and/or MAC address?), things might be quite simple.

EDIT: ... and probably on the edge of being off-topic for Network Engineering, because more related to host and client configuration than anything else.

Try this:

  • connect the server to its new home network and give it suitable IP address, mask and gateway settings.
  • Adjust DNS entries and/or client side configurations as needed, pointing to the server's new IP address.

Then, try to fool the software/licensing into believing the server still has its old IP address:

  • add a dummy NIC to that server, and connect it to some stub vlan of the new site (or plug a loop cable into it), anything to make the NIC it appear as "up". The subnet mask might even be, if the operating system supports it.
  • configure that dummy NIC it with the old/licensed IP address and the longest subnet mask possible/supported by the OS.
  • Make sure that the original network has no active IP addresses in the IP range covered by the dummy NIC's IP and subnet mask.

(If there's even a MAC/IP combination involved with licensing, then just keep using the current NIC as the dummy one in the stub network, and add a new NIC for the "proper" network).

If however, the unchangeability is because client software cannot be reconfigured (in extenso: hard-coded IP addresses), then that won't help, I'm afraid, and you'll probably have to resort to the poison cabinet of networking, where bottles labelled "static routes on client systems" and "proxy arp" (see Peter Green's answer) are kept, and where you'll also find the jar with the "obscure NAT" pills.

  • Thanks for your answer Marc, and yes, unfortunately it's a case of hard-coded IP addresses.
    – Cragmuer
    May 31 '19 at 20:48
  • 1
    ... there should be implicit retro-active contractual penalties for any developer or company, ranging from "large percentage of annual renveue" fines to things close to violating the geneva conventions, for delivering a product that is fundamentally broken in such a way... sigh. May 31 '19 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.