We have two industrial machines (let's call them Holding and Media) with configured network addresses and respectively. Currently they are isolated physically although logically in same subnet. There is no option to change any config in the machines (it's very old controllers so it's near impossible without lot's of overhead). We need to connect these machines to another machine running windows 10 with OPC server and with 4 NICs. We would like to keep single machine and single OPC server if possible for lower complexity and costs (OPC server with the required drivers is costly) AND keep the machines segregated as before connection - (ZERO traffic leak between machines) - to avoid unexpected behaviors and as well for better cyber protection. The diagram is below:

enter image description here

What we have tried is naively configuring 2 NICs to have same subnet intending latter to add route for Media and for Holding to find out the way out the Windows. Using Windows Settings and NetSetMan. Seems that windows does not complain, but inspecting ipconfig and "route print" shows that only one NIC is actually properly configured.

Please suggest our alternatives, what would you do ? Thanks. Alex

As kindly suggested by Ron Maupin, moved the Q here: https://serverfault.com/q/1058799/355759

  • Unfortunately, host/server configurations are off-topic here. You could try to ask this question on Server Fault for a business network.
    – Ron Maupin
    Mar 29, 2021 at 14:24

1 Answer 1


By the way, are no private IP addresses. You should never use public addresses that you're not authorized to. Check out RFC 1918.

There are two basic approaches:

  1. You configure a separate network (p2p, switch, VLAN) for each machine and connect one server NIC to each network (but both within the subnet or larger - which subnet mask to the machines use?). Then you use explicit entries in the server's routing table with low metrics to control which destination goes out of which interface. Note that host configurations are explicitly off-topic here.
  2. You create a shared network (VLAN) but use a switch with a private VLAN aka port isolation option to inhibit traffic between the machines' ports, just permitting traffic between the server and each machine.

I'd prefer #2 but after all, this is the Network Engineering site...

Not the answer you're looking for? Browse other questions tagged or ask your own question.