Subnet & VLAN Planner

What to enter and where to find each number

The planner needs three things: one block of addresses for the whole site, a list of VLANs with the number of devices in each, and how much room to leave for growth.

• Base network. The address block you will split, written like 10.10.0.0/16 or 192.168.0.0/22. On an existing site, look at the LAN page of the router or firewall and the DHCP scope. For a new site, pick a private range (10.x.x.x, 172.16–31.x.x or 192.168.x.x). The prefix must be between /8 and /30.
• Hosts needed. Devices in each VLAN today. Count them from the DHCP lease list on the router, the camera list on the NVR, the phone list on the IP-PBX and the access point list on the Wi-Fi controller. Do not forget printers, switches and door controllers. For guest Wi-Fi, use the peak number of connected clients from the controller, not the number of rooms or seats.
• VLAN ID. Any number from 1 to 4094. The tool warns about duplicates and about VLAN 1, which is the default VLAN on every switch.
• Growth headroom. 30% by default. Leaving room now is far cheaper than re-numbering cameras and printers in two years.

How the planner sizes and places each subnet

1. Addresses needed = hosts × (1 + headroom), rounded up, plus 1 for the gateway.
2. Each VLAN gets the smallest subnet whose usable count, 2^(32 − prefix) − 2, covers that number.
3. Subnets are sorted largest first and placed back to back from the start of the base network (VLSM). In that order each one starts on its own block boundary, so nothing overlaps. Subnets of equal size keep the order of your rows.
4. The gateway is the first usable address. The usable range runs from the gateway to the address before broadcast, so the addresses left for devices are usable − 1.

The big number in the results is "Addresses allocated" out of the base size. "Addresses left" is what remains for future VLANs. If the plan does not fit, the VLANs that found no room are listed in red: use a shorter prefix or fewer hosts. The headroom is the only margin. The tool does not reserve a block for fixed IPs; you do that inside each range.

Worked example: office and warehouse on 192.168.0.0/22

An office with a warehouse in Vientiane, base 192.168.0.0/22 (1,024 addresses), the six preset rows and 30% headroom.

The arithmetic: 150 × 1.3 = 195, + 1 = 196, more than a /25 (126) so a /24. 60 × 1.3 = 78, + 1 = 79, so a /25. 40 × 1.3 = 52, + 1 = 53, so a /26. 30 × 1.3 = 39, + 1 = 40, also a /26. 20 × 1.3 = 26, + 1 = 27, so a /27. 10 × 1.3 = 13, + 1 = 14, exactly the 14 usable of a /28: a tight fit with 13 addresses for devices.

Allocated: 256 + 128 + 64 + 64 + 32 + 16 = 560 of 1,024, leaving 464. Second check by block: guest ends at .0.255, office at .1.127, CCTV at .1.191, VoIP at .1.255, servers at .2.31, management at .2.47. 2 full /24 blocks (512) plus 48 = 560.

Now shrink the base to a /23 (512). The first four VLANs use 256 + 128 + 64 + 64 = 512 exactly, so Servers and Management have no room and are flagged. Set headroom to 0% on the /22 instead and Office drops to 61 needed, a /26 with one address to spare. That is why we keep the headroom.

Turning the plan into switch and firewall settings

• Put each gateway on the firewall or a layer-3 switch, then write rules between VLANs. VLANs only separate traffic if the router does not let every VLAN reach every other. See VLAN basics for business.
• Guest Wi-Fi gets internet only, with client isolation on the access points. More in Wi-Fi security, WPA3 and guest isolation.
• CCTV talks to the NVR and nothing else.
• Reserve a small block in each range for fixed-IP devices (switches, access points, printers, NVRs) and keep DHCP out of it.

Common mistakes we see on Lao sites

• One flat 192.168.1.0/24 for everything, with cameras, guests and the accounts PC in the same broadcast domain.
• A branch on 192.168.1.0/24, the same range as most home routers. Staff on VPN from home then cannot reach the office.
• VLANs on the switch but an "allow all" rule on the router, so the separation exists on paper only.
• An unmanaged switch in the middle of a VLAN design. It cannot keep VLANs apart on its own ports. See managed vs unmanaged switch.

When the planner is not enough

The tool plans one base network. Several branches, a mine camp linked by radio, or an existing site full of fixed-IP cameras and PLCs that must be re-addressed without downtime need a survey: we read the current DHCP leases, switch configs and firewall rules, then plan the change in stages. That is part of our enterprise LAN and next-generation firewall work.

Next step

Send us on WhatsApp the plan you copied with "Copy as text", a screenshot of your router's LAN and DHCP page, and the models of your switches. Tell us how many sites you have. We will check the plan and tell you what needs a managed switch or a firewall rule.