试图了解同一网络上两个不同子网之间的交互

子网掩码的理论是，它定义IP地址的哪一部分是网络地址以及IP地址的哪一部分是主机地址：

10.100.0.1 - IP地址;

255.0.0.0 - 子网掩码;

10-网络地址，100.0.1-主机地址。

Hosts within same subnet can talk directly to each other. That means if host A and B are located within the same subnet and A wants to talk to B then A will send it's traffic directly to B. If host A wants to talk to host C which is located in a different subnet then A will have to route this traffic to the gateway which knows (hopefully) how to reach different network. So, it is up to the host to define where to send traffic:

1. Directly to the host (second host is within the same subnet)
2. To the gateway (second host belongs to a different subnet)

What happens in your case is that your "Authorized" clients have IP addresses 10.100.0.10 - 10.100.0.250 (I assume the subnet mask is 255.0.0.0). The server has IP address 10.100.0.1. To a host from the "Authorized" range this server is located in the same subnet.

如果10.100.0.10“授权”范围内的主机希望与服务器通信-它首先检查该服务器是否位于同一子网内。对于10.100.0.10具有子网掩码的主机，255.0.0.0同一子网将是该范围内的所有主机10.0.0.1 - 10.255.255.254。服务器的IP地址恰好在此范围内。因此，“授权”范围内的主机尝试直接访问服务器，并且（假设它们位于同一第2层网络上）尝试成功。

在这种情况下，即使服务器具有不同的子网掩码-它也位于更大的子网中（这也是“授权”客户端的子网）。如果您的服务器IP地址中的第二个字节不同（10.150.0.1例如），它将无法从“授权”范围答复主机，因为从服务器的角度来看，“授权”范围看起来像是另一个子网和服务器。需要将流量发送到路由器。如果没有路由器-那么将不会有通信。

如果要将网络分为“来宾”和“授权”部分，则需要使它们位于不重叠的不同子网中。

例如：

1. “访客”- 10.10.0.1，子网掩码255.255.0.0
2. "Authorized" - 10.20.0.1, subnet mask 255.255.0.0

Server would be located within "Authorized" part of the network having IP address 10.20.0.100, subnet mask 255.255.0.0.

With this setup these subnets will be effectively separated from each other, since parts of IP addresses representing their subnet will differ:

1. 10.10 for Guests
2. 10.20 for Authorized

At this point communication between these subnets will be possible only via router that has interfaces in both subnets.

Also, it is worth mentioning, that while all your computers share same Layer 2 network nothing will prevent a Guests to manually assign themselves IP addresses from the "Authorized" range. This will effectively make them to be part of the Authorized network.