Subnet & VLAN Plan
Give it a private block and what each VLAN is for, and it lays out subnets that do not overlap and do not fragment the block. Then it keeps checking as you edit — overlaps, DHCP ranges outside their own subnet, a VLAN you have outgrown — and prints the whole thing, because when the network is down a web page is the one thing you cannot reach.
1 The plan
Name it and give it a private block to carve up. Everything else is allocated out of this, so it is the one number worth getting right before anything else.
This browser will not keep saved work — storage is blocked, or this is a private window.
2 VLANs and addressing
What each VLAN is for and how many hosts it needs. Let it allocate the subnets, or type your own and have them checked — overlaps and DHCP ranges outside their subnet are found either way.
This browser will not keep saved work — storage is blocked, or this is a private window.
3 What reaches what
The intent matrix, plus the exceptions that are the whole reason a segmented network is worth the trouble. Intent, not firewall syntax.
This browser will not keep saved work — storage is blocked, or this is a private window.
4 Static addresses
Reservations and fixed addresses, checked against the subnet they claim to be in and against each other.
This browser will not keep saved work — storage is blocked, or this is a private window.
5 The 2am sheet
The whole plan on one page, printable. When the network is down this page is unreachable, so print it before you need it.
This browser will not keep saved work — storage is blocked, or this is a private window.
Print this before you need it. This site is written for the thing that breaks at 2am, and when the network is down a web page is precisely what you cannot reach. The plan is only useful if it exists on paper.
What it works out
- The allocation. Give it a base block and the host count each VLAN needs, and it lays out non-overlapping subnets sized to the next power of two, largest first so the block does not fragment. Laying that out by hand is the part people get wrong, and they get it wrong silently — two subnets that overlap route fine until the day they do not.
- The checks, continuously. Overlaps between any two subnets, a DHCP range that falls outside its own subnet or collides with a static reservation, a VLAN whose host count has outgrown its prefix, a static address in the wrong subnet, a duplicate VLAN ID.
- Capacity honestly. A
/24holds 254 usable addresses, not 256 — the network and broadcast addresses are not hosts. A tool that quietly counted 256 would tell you a 254-device VLAN fits.
What is standard, and what is yours
The private ranges are RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and
192.168.0.0/16. VLAN IDs run 1 to 4094, with 0 and 4095 reserved by
IEEE 802.1Q. Those are cited where they are applied and neither of them
changes. Everything else — which VLANs you want, what they are for, what may
reach what — is yours, and the tool has no opinion about it.
What it will not do
It emits no firewall configuration. Not pfSense, not OPNsense, not UniFi, not iptables, not nftables. A generated rule that is subtly wrong for your firewall's version fails open, and a rule that fails open looks exactly like one that works right up until something reaches the camera VLAN. What it gives you is the intent — which VLAN may reach which, and the specific exceptions — in a form you can implement and check yourself.
It also makes no judgement about your segmentation. Whether cameras should be isolated, whether guests should reach the printer, and how many VLANs a household needs are decisions about your house and your risk, not arithmetic.
Saved work stays in this browser unless you sign in. Download a backup before clearing browser data or moving to another device.
Your copy
Download everything saved in this browser, or restore a backup on this device.