sysop@hub:~/tools/ip-plan-builder$

ip-plan-builder

Give the page your address range and the segments you need. It cuts the range into subnets that do not overlap, sized for the hosts you expect, and hands you the plan as a table and as configuration for the switch and the DHCP server.

the range

Address range Room to grow, in % Layout

the segments

start from

Details for the DHCP exports

DNS servers DNS domain

rules of thumb

Separate by trust, not by department. Servers, clients, guests, phones, printers and "things" (cameras, building control, TVs) each get a segment, because they deserve different firewall rules.
Guests reach the internet and nothing else. The guest segment must not reach any internal address, including the management interfaces of your own devices.
Management lives alone. Switches, access points, hypervisors and out-of-band interfaces in one VLAN that only admin workstations can reach.
Avoid the popular ranges. 192.168.0.0/24, 192.168.1.0/24 and 192.168.178.0/24 are in millions of homes. VPN users with the same range at home cannot reach yours.
Readable beats tight. With a 10.x.0.0/16 there are 256 /24 networks. Spending one per VLAN, with the VLAN ID in the address, saves more time in troubleshooting than tight subnets ever save in addresses.
Write it down where the next person finds it. The plan is only useful while it matches reality.

A VLAN separates nothing by itself: traffic between VLANs is allowed or blocked by the device that routes between them. Put the gateways on a firewall, or use access lists on the switch that routes. IPv4 only. The generated configuration is a starting point: read it before you paste it.