Configuring Multiple Subnets on a Single LAN Interface

APPLICABLE PRODUCTS 

Anybus Defender Series 4000 and up

VERSIONS USED IN THIS ARTICLE

• Anybus Defender 2.5.2-2025111723

Introduction

In some installations, multiple IP subnets may need to exist on the same Anybus Defender LAN interface without being treated as separate security zones.

It is important to distinguish this configuration from network segmentation. Using different IP subnets does not by itself create separate security zones. Devices connected to the same physical LAN or Layer 2 network are still part of the same network segment, even if they use different IP address ranges.

For security zoning and segmentation, separate VLANs or physical interfaces should be used together with firewall rules between the zones.

However, when the requirement is simply to have two or more IP subnets within the same zone, the Anybus Defender can be configured with an additional Virtual IP using an IP Alias.

In this example, the LAN interface uses:

The goal is to allow a device at 192.168.200.100 to communicate with a device at 192.168.230.100 through the Defender.

Example Topology

Both networks are associated with the same LAN interface and therefore belong to the same zone.

1. Configure the Primary LAN Interface

First configure the normal LAN interface.

Go to:

Interfaces → LAN

Configure the LAN interface with:

Save and apply the configuration.

The Defender is now directly connected to:

192.168.200.0/24

2. Add the Second Subnet as a Virtual IP

To add the second subnet, go to:

Firewall → Virtual IPs

Click Add.

Configure the Virtual IP as follows:

The other IP Alias settings can normally remain at their defaults.

Click:

Save

and then apply the configuration.

The LAN interface now effectively has two IP addresses:

LAN

├── 192.168.200.1/24

└── 192.168.230.1/24

The second address is provided through the IP Alias.

3. Configure Devices on Subnet 1

Configure the device on the first subnet, for example:

IP address:     192.168.200.100

Subnet mask:    255.255.255.0

Default gateway: 192.168.200.1

The default gateway is the primary LAN address of the Defender.

4. Configure Devices on Subnet 2

Configure the device on the second subnet, for example:

IP address:     192.168.230.100

Subnet mask:    255.255.255.0

Default gateway: 192.168.230.1

The gateway for this subnet is the Virtual IP configured on the Defender.

5. Configure Firewall Rules

The Defender automatically has routes to both directly connected networks once the IP Alias has been created.

No additional static route should normally be necessary.

However, the firewall must still permit communication between the two subnets.

Go to:

Firewall → Rules → LAN

Create a rule allowing the required traffic.

For initial testing, an ICMP rule can be used.

Rule 1 – Subnet 1 to Subnet 2

Save and apply.

If devices on the second subnet also need to initiate communication toward the first subnet, create the corresponding rule:

Rule 2 – Subnet 2 to Subnet 1

For production use, replace broad ICMP/Any rules with rules permitting only the protocols required.

6. Test Communication

From the device:

192.168.200.100

ping:

192.168.230.100

If the firewall rule permits the traffic, communication should work immediately.

Although there are two IP subnets:

192.168.200.0/24

192.168.230.0/24

they should not be considered two separate security zones when they use the same LAN interface and Layer 2 network.

In this configuration:

Different subnets ≠ network segmentation

The two subnets are simply routed IP networks associated with the same Defender LAN zone.

If the requirement is to isolate devices for security purposes, use separate VLANs or physical interfaces instead.

Firewall rules can then explicitly control traffic crossing from one security zone to another.

Summary

For multiple subnets within the same zone, the recommended simple configuration is:

LAN:      192.168.200.1/24

IP Alias: 192.168.230.1/24

The Defender automatically provides routing between the directly connected subnets, while firewall rules determine which traffic is permitted.

Use IP Aliases for multiple subnets in the same zone and use VLANs or separate physical interfaces when actual security segmentation is required.

© HMS Networks AB 2026