Communication with different subnet masks

Question

So I try to explain the dilemma.

I have 2 groups of clients and one server. I want these groups to only communicate with the server. This means that each device in these groups should see the server, but not the devices in the other group.

Is it even possible?

I tried to solve this problem by assigning different masks like this:

  Server:         192.168.1.1 / 255.255.255.0
  GroupA:  192.168.1.10 - 120 / 255.255.255.128
  GroupB: 192.168.1.130 - 250 / 255.255.255.128

I thought if I do it like this these groups can't see each other but they can see the server. It turns out that due to the different mask they can't see the server either. Or am I missing something?

It would be much better if the devices in the same group couldn't see each other too, but I guess that's not possible, right?

Answer 1

You’re trying to solve this problem at the wrong layer.

If you want to filter nodes in a single subnet from talking to each other, but allow common access to servers, look at something like Private VLANs - most decent switch vendors support this.

Answer 2

I have 2 groups of clients and one server. I want these groups to only communicate with the server. This means that each device in these groups should see the server, but not the devices in the other group.

There are multiple ways to achieve that.

1. use a managed switch and configure its private VLAN or port isolation so that the client ports can only communicate with the server port
2. use a managed switch and configure an ACL on the client ports so that the client IP addresses can only communicate with the server IP address
3. separate your clients and the server into three VLANs and allow only client-server communication on the L3 switch/router/firewall between the VLANs
4. add a second NIC into your server and use two separate switches

I tried to solve this problem by assigning different masks like this

The problem with that is that your server is only part of the one subnet and not of the other. You'd need to add a second IP address to your server for the second subnet.

However, there's no real security as communication is only separated as long as each client keep to its IP address. No one's stopping a client to add an IP address from the other subnet. You need to have some separation on the network level.

It would be much better if the devices in the same group couldn't see each other too, but I guess that's not possible, right?

That's quite possible with options 1 and 2 above.