How to Plan IP Addressing for a Growing Network

Plenty of small networks start life on whatever the router chose out of the box, usually 192.168.1.0/24 with DHCP handing out addresses as devices appear. That works fine for a dozen devices. It starts to creak at fifty, and by the time there are printers, cameras, phones, access points, and a few servers, nobody can say with confidence which address belongs to what.

A bit of planning early avoids that mess. This guide covers how to carve up private address space, when to use VLANs, how to handle DHCP and static addressing, and which hardware choices make the plan easier to implement.

Pick a Private Range With Room to Grow

Private IPv4 ranges are set out in RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Home routers favor 192.168.0.x and 192.168.1.x, which is exactly why those ranges cause trouble at work. When staff connect over a VPN from home networks using the same range, traffic ends up going to the wrong place.

Choosing something less common, such as a block inside 10.0.0.0/8, reduces those clashes and gives far more space. A simple pattern is to reserve one /16 per site and divide it into /24 subnets by function, so the third octet tells you what a device is. For example, 10.20.10.0/24 could hold staff computers, 10.20.20.0/24 voice, 10.20.30.0/24 cameras and 10.20.99.0/24 network management.

Write the plan down before configuring anything. A shared document listing each subnet, its VLAN ID, its gateway, and its purpose is not glamorous, but it becomes the single source of truth everyone works from.

Match VLANs to Subnets on Managed Switches

A subnet on paper only becomes a boundary when the network enforces it. That is the job of VLANs. Each VLAN maps to one subnet, and the router or layer 3 switch routes between them under rules you control. Cameras can reach the video recorder but not the accounts PC, and guests reach the internet but nothing internal.

This needs managed switches that support 802.1Q tagging. Unmanaged switches cannot carry VLANs, so they quietly flatten your plan wherever they are used. Networking suppliers such as CtrlOps stock managed and PoE switches from brands including Cisco, Cisco Meraki and MOXA, along with the routers and gateways that sit above them.

Keep VLAN IDs consistent with the address plan. If the camera subnet is 10.20.30.0/24, making it VLAN 30 saves a lot of head scratching later, especially for whoever inherits the network.

Size each subnet for where it is heading, not where it is today. A /24 gives 254 usable addresses, which is plenty for most functions, but a busy guest network in a large office can outgrow it. In that case, a /23 is a cleaner fix than squeezing in a second guest subnet later and splitting the rules between them.

Decide What Gets DHCP and What Stays Static

Most devices should get addresses from DHCP. Laptops, phones, and guest devices come and go, and manual addressing for them wastes time. Each VLAN needs its own DHCP scope, served either by the router or a dedicated server, with a DHCP relay configured wherever the server sits on a different subnet.

Infrastructure is different. Switches, access points, firewalls, printers and video recorders are easier to manage with fixed addresses. You can set these statically on the device itself or use DHCP reservations tied to MAC addresses. Reservations keep everything in one place, which helps when someone else has to troubleshoot. Lease times are worth a look as well. Short leases suit guest networks where devices churn quickly, while longer leases reduce chatter on staff and voice subnets where the same devices return every day.

Leave a clear gap in each subnet. Many teams keep the first twenty or so addresses for gateways and infrastructure and let DHCP hand out the rest. Document that rule so nobody assigns a static address inside the dynamic pool and creates a conflict that only shows up on a busy morning.

How PoE and Cabling Shape the Plan

Physical choices feed back into the address plan. PoE switches power access points, phones, and cameras directly, which tends to cluster those devices on particular switches. One switch might end up carrying most of the camera VLAN, which makes it easier to apply the right rules at the port level.

Cabling sets limits too. Copper Ethernet runs top out at 100 meters, so larger buildings often link switches over fiber using SFP modules or media converters. Every one of those switches needs a management address, and a dedicated management subnet planned from the start keeps them reachable even when a user VLAN is misconfigured.

It is also worth checking cable grade before assuming a link problem is a configuration problem. A damaged patch lead or an old run that cannot hold gigabit speeds will produce dropped DHCP requests and slow logins that look a lot like an addressing fault.

Leave Space for IPv6

Even if the network runs on IPv4 today, plan for IPv6. Many ISPs already hand out IPv6 prefixes, and devices will use them when they are offered. A site often receives a /56 or /48, which allows a /64 for each VLAN. Matching IPv6 subnet IDs to VLAN numbers, so VLAN 30 uses subnet ID 30, keeps the two plans aligned. The Internet Engineering Task Force publishes the RFCs behind private addressing, DHCP and IPv6, and the original documents are more readable than their reputation suggests.

A good addressing plan rarely gets noticed, which is the point. When the network grows, new devices land in the right place, and when something breaks, the address alone tells you where to look.