Tjyylli

I've got a similar issue to Allow two subnets to talk to each other over a wireless bridge

where my ISP's Modem/Router was the DHCP server and everything on my network was on the 192.168.1.x subnet, but I bought a second Netgear router to replace a Wifi repeater as I wanted a more reliable signal but also better parental controls.

Unfortunately to be able to use parental controls, the second router (connected to the ISP modem/router via Ethernet) forces me to configure it over a WAN connection to my modem/router and use a new 192.168.2.x subnet with it acting also as a DHCP server.

Now my devices connected to my modem/router on 192.168.1.x can't see everything else connected to the Netgear on 192.168.2.x.

What's the best way to resolve this? Configure both modem/router and Netgear router to use a subnet mask of 255.255.224.0? Or is there more to it than that? Sorry I'm at the limit of my networking knowledge!!

thanks

The subnet mask informs devices about whether direct communication is possible ("direct" here means "at Ethernet/MAC layer"). However, it doesn't physically make those communications possible – and in your case, they are not, because there is a router in the middle.

Generally, the subnet mask trick would only work if you switched the Netgear into "bridge" mode and put all devices on a single network with no isolation between them – which indeed is the usual suggestion when people just want a second Wi-Fi access point and have no actual need for the routing functionality.

But as you've stated, you specifically want a router in order to keep the two subnets separate. So using a broader subnet mask is generally the wrong choice because it's the opposite of what you want, and it won't work anyway with a router in the middle.

Method 1

There's an exception to the above: you can use a broader subnet mask if the middle router supports the "Proxy ARP" feature. Enabling this makes the router respond to direct ARP queries on behalf of devices on the "other side", essentially tricking devices into thinking that they're sending packets directly to the other device, while in reality they're talking to a router.

So if the Netgear supports "Proxy-ARP", enable it only on the WAN interface (facing the ISP-router), and then you can configure devices on 192.168.1.x to use a broader subnet mask such as /22 (255.255.252.0) or indeed even /19 (255.255.224.0), although the latter is unnecessarily broad.

Note that the 192.168.2.x side is not changed, as it can already successfully send packets to the ISP-router's subnet due to the Netgear being directly connected to both subnets.

Method 2 and 2½

Routers can already forward traffic between different subnets without any of this proxy-ARP trickery; indeed that's what routers do. Usually the main configuration that is necessary is to tell each side about which router to use for reaching which subnet.

So what you should do is configure a "static route" towards 192.168.2.0 on your ISP-issued router. In the route settings page, fill in the Netgear 'WAN' (192.168.1.x) address as the "gateway" to use.

If the ISP-router makes this impossible, you can also configure the same route on each 192.168.1.x computer individually; that's the second option. (Windows/Linux/macOS support route configuration via ip route or route commands, but other devices usually don't.)

The reverse route does not need to be added manually – the Netgear already has an automatic route to 192.168.1.0 because it is directly attached to that subnet, after all.

There's a slight downside to the second method above (i.e. configuring a route on the ISP-router) – it means all packets from 192.168.1.x to 192.168.2.x first go towards the ISP-router and are bounced back towards the Netgear. It isn't the most efficient data path, but it'll do.

The other two methods do not have this problem. On the other hand, configuring routes on individual computers can be a lot of manual work, meanwhile proxy-ARP is usually not available on low-end routers. (Also, proxy-ARP is the duct tape of networking and I shouldn't have listed it as the first option or possibly even at all, but it'll do.)