FREN

Networking / Tool

Home / Networking

VLAN addressing planner: networks, gateways and DHCP servers

List your VLANs and how many hosts each one has: the tool works out the complete addressing plan (network, mask, gateway, static addresses, DHCP range and broadcast), with a /24 per VLAN or a tight VLSM fit. It suggests the DHCP configuration for each VLAN (on the gateway or relayed to a dedicated server) for dnsmasq, Kea and Windows Server, flags mistakes and exports the plan as CSV or Markdown.

Networking Tool Intermediate Published October 21, 2026 Translated October 27, 2026 4 min read Version française
Network cables plugged into a device, close-up
Photo: Jandira Sonnendeck on Unsplash

In plain words

Splitting a network into VLANs means giving each department (administration, offices, guests, cameras…) its own neighbourhood, with numbered streets and its own town hall (the gateway). The tool draws up the land register: it works out each neighbourhood's addresses without overlap, reserves static addresses for equipment and leaves the rest to DHCP. Everything is calculated in your browser.

The three methods

Method How it works When to choose it
/24 per VLAN, 3rd byte = ID VLAN 30 becomes 10.10.30.0/24, gateway 10.10.30.1. With a block smaller than a /16 (for example 192.168.1.0/24), the /16 containing it is used: VLAN 30 becomes 192.168.30.0/24 Most small businesses and homelabs: the plan reads without documentation, and each VLAN has 254 addresses
/24 per VLAN, one after another VLANs receive consecutive /24s starting from the block entered, in ID order IDs above 255, or an imposed range that starts at a specific point
VLSM (tightest fit) All VLANs share the block entered: each one gets the smallest network that covers its needs (margin included), largest first Limited address ranges (site-to-site VPN, imposed block), or VLANs with more than 254 hosts

DHCP for each VLAN

Each VLAN is a separate network: it needs its own DHCP scope, with its gateway and options. The DHCP server column says who hands out the addresses:

Choice How it works Typical case
On the gateway The firewall or router carrying the VLAN interface hands out the addresses itself Small business, homelab: OPNsense, pfSense, UniFi, MikroTik, advanced home router
Dedicated server (relay) The gateway relays requests to a central DHCP server (ip helper-address), which picks the scope from the gateway's address Corporate network with Windows Server or Kea, several sites
None The whole network uses static addresses DMZ, server or infrastructure networks

The tool generates the matching configuration: a summary valid for any equipment, and files ready to adapt for dnsmasq (Pi-hole, OpenWrt), Kea (Linux) and Windows Server (PowerShell), plus the relay configuration. The options available:

  • DNS server: each VLAN's gateway, an internal DNS, or a public DNS (Quad9).
  • Local domain (option 15): use home.arpa, reserved for this purpose, or a subdomain of a domain you own. Avoid .local, reserved for mDNS.
  • Lease time: 24 hours suits most networks; guest VLANs automatically get a 2-hour lease to free up visitors' addresses quickly.

Check before going live

Test the generated configuration on one VLAN before rolling it out everywhere, and make sure no other DHCP server (home router, old router) answers on the same VLANs: two DHCP servers on one network hand out conflicting addresses.

The default plan follows SPOTech Lab's firewall series: ADMIN, OFFICES, SERVERS, IOT, GUESTS and DMZ in 10.10.0.0/16. See Understanding firewalls.

What the tool checks

  • VLAN IDs (from 1 to 4094) and duplicates.
  • Use of VLAN 1, the default VLAN on every switch, to be avoided for data.
  • VLANs 1002 to 1005, reserved on many Cisco switches.
  • Overflowing the starting block, and networks too small for the need, margin included.
  • Use of public ranges and of 192.168.0.0/24 or 192.168.1.0/24, sources of conflict with users' home routers over VPN.
  • A DHCP range smaller than the number of planned hosts.
  • A dedicated DHCP server placed inside a DHCP range, or outside the plan's VLANs.
  • A local domain ending in .local, and an internal DNS given to guests.

After the plan

  1. Create the VLANs on the switches and Wi-Fi access points, with the same IDs everywhere.
  2. Create the VLAN interfaces on the firewall or router, then the DHCP scopes (or the relay) with the suggested configuration.
  3. Write the filtering rules between VLANs: block everything by default, then open only what is strictly needed.
  4. Document the plan: the CSV or Markdown export drops straight into a knowledge base.

The detailed steps are in OPNsense: the complete setup and UniFi: configuring the firewall. To check a specific network, use the IP and subnet calculator.

Sources

Read next