Home Network Subnet Planning

Plan Your Network Right Here

If you just want the answer: toggle the VLANs you need below, pick a base network, and copy the table. Every value is editable, the plan recalculates live, and each subnet links to our Subnet Calculator for the full breakdown. The rest of this guide explains why the defaults are what they are.

Why Segment a Home Network at All?

A flat network — one subnet where the TV, your work laptop, the robot vacuum, and your NAS all sit together — is how nearly every home network starts, and it is fine until it isn't. The problem is trust: a $30 smart plug with firmware that stopped receiving updates in 2022 sits on the same broadcast domain as the laptop you use for banking. If that plug is compromised, there is nothing between it and everything else you own.

Segmentation puts devices into separate subnets by trust level, with a firewall (your router) deciding what can talk to what. The standard building block is the VLAN: a virtual LAN that lets one physical switch carry multiple isolated networks, each tagged with an 802.1Q VLAN ID from 1 to 4094. Your router gives each VLAN its own subnet and routes — or refuses to route — between them.

The classic home segmentation, reflected in the planner's defaults:

• Management — the router, switches, access points, and IPMI interfaces. The most sensitive network you have; nothing else should reach it.
• Trusted LAN — your personal computers and phones. Can reach most other VLANs.
• IoT — smart home devices, TVs, speakers. Can reach the internet but not your LAN. (Exceptions like casting need mDNS reflection, which most router OSes support.)
• Guest — visitor devices. Internet only, isolated from everything, ideally with client isolation on the Wi-Fi side too.
• Cameras — security cameras are the most notoriously insecure device class. Many people block them from the internet entirely and only allow the NVR to reach them.
• Homelab — servers, VMs, and containers. Sized larger (a /23 in the defaults) because lab experiments multiply addresses fast.

The 192.168.1.0/24 Trap

The single most common home networking mistake is keeping your router's default subnet — usually 192.168.0.0/24 or 192.168.1.0/24. It works fine until the day you set up a VPN back into your house and try to connect from a hotel, a coffee shop, or a friend's network that uses the same subnet. Your laptop now has two routes to 192.168.1.1: one local, one through the tunnel. The local route wins, and your VPN silently fails to reach anything at home.

Because consumer routers overwhelmingly default to 192.168.0.x and 192.168.1.x, the fix is simply to be unusual. Two good options:

• Move within 192.168: start at 192.168.10.0 or higher. 192.168.20.0/24 will basically never collide with a hotel network.
• Move to 10.x space (recommended): pick a random-ish block like 10.10.0.0/16 or 10.83.0.0/16. You get 65,536 addresses of room, VLAN subnets can mirror their VLAN IDs (VLAN 20 → 10.10.20.0/24), and collisions are rare.

The planner warns you automatically if your plan lands on the collision-prone defaults. All three base choices come from the RFC 1918 private ranges — anything else will break internet routing.

How Big Should Each Subnet Be?

A /24 (253 usable hosts after the network, broadcast, and gateway addresses) is the right default for almost every home VLAN. It is one octet — easy to read at a glance — and no home has 250 guests. Deviate in two cases:

• Smaller (/26) for infrastructure: Management and camera VLANs hold a handful of devices. A /26 (61 hosts) keeps them tidy, though even this is generous.
• Larger (/23) for the lab: if you run Proxmox, Kubernetes, or Docker at home, addresses evaporate. A /23 gives 509 hosts; with a /16 base you can afford it without a second thought.

Don't over-optimize. The instinct to right-size every subnet down to the host count comes from the days of scarce public IPv4. Inside 10.0.0.0/8 you have 16.7 million addresses; clarity beats efficiency. If you want to see exactly what any prefix gives you, the subnet cheat sheet has the full table.

Conventions Worth Stealing

These aren't rules, but they make a network self-documenting:

• VLAN IDs in multiples of 10 (10, 20, 30…) grouped by trust level, leaving room to insert a VLAN 25 later without renumbering.
• Third octet mirrors the VLAN ID: VLAN 30 lives at 10.10.30.0/24. Six months from now, a packet capture showing 10.10.30.47 tells you instantly it's an IoT device.
• Gateway at .1 of every subnet — the planner assumes this.
• Static assignments low, DHCP high: the planner reserves the lower half of each subnet for static IPs and DHCP reservations (servers, printers, APs) and puts the DHCP pool in the upper half. Where a device's address falls tells you how it was assigned.

Firewall Rules Between VLANs

Subnets only create the possibility of isolation — your router's firewall rules do the actual work. The standard policy set, from most to least trusted:

The key phrase is allow established: your laptop on the Trusted LAN can open a connection to a camera or a smart plug, and the reply traffic is permitted — but the IoT device can never initiate a connection back. Stateful firewalls (OPNsense, pfSense, UniFi, MikroTik) all express this directly.

A Worked Example

Here is the plan the widget produces with all six VLANs enabled on 10.10.0.0/16, following the VLAN-ID-in-the-third-octet convention manually (the planner packs contiguously by default; edit sizes to taste):

Base: 10.10.0.0/16
|
+-- VLAN 10  Management   10.10.0.0/26    router, switches, APs
+-- VLAN 20  Trusted LAN  10.10.1.0/24    computers, phones
+-- VLAN 30  IoT          10.10.2.0/24    smart home, TVs
+-- VLAN 40  Guest        10.10.3.0/24    visitors
+-- VLAN 50  Cameras      10.10.4.0/26    cameras + NVR
+-- VLAN 60  Homelab      10.10.6.0/23    servers, VMs, k8s

~1,500 of 65,536 addresses used — 97% free for whatever comes next.

Notice how much space is left over. That headroom is the point of a /16 base: when you add a dedicated VLAN for a 3D printer farm or a kids-devices network next year, you extend the plan instead of rebuilding it.

Common Questions

Do I need managed switches and special hardware?

For VLANs, yes — the switch and access points must support 802.1Q tagging, and your router must support inter-VLAN routing with firewall rules. Entry-level managed switches are inexpensive now, and prosumer platforms (UniFi, Omada, MikroTik) or open-source router OSes (OPNsense, pfSense, OpenWrt) all handle this well. If your hardware doesn't, you can still get some benefit from a separate guest Wi-Fi SSID, which most consumer routers isolate for you.

Should I use IPv6 instead?

Run it alongside, not instead. Dual-stack is the practical reality: your ISP likely hands you a /56 or /64 prefix, and segmentation concepts carry over (one /64 per VLAN). But every device you own still speaks IPv4, so plan the IPv4 layout first. See IPv4 vs IPv6 for the differences.

What about Docker and Kubernetes at home?

Container platforms bring their own internal networks (Docker defaults to 172.17.0.0/16 — another reason to avoid basing your home network there). Give the hosts a homelab VLAN address and let the container network live inside it. If you later peer them (e.g., MetalLB or BGP to your router), you'll be glad the homelab VLAN is a roomy /23.