VLAN ID Planner
Paste the VLAN IDs you plan to use and check them against the 802.1Q range before they reach a switch. The tool finds out-of-range values, duplicates, and the free blocks left over for the next site or segment.
Comma or space separated. 802.1Q allows 1 to 4094; 0 and 4095 are reserved.
IDs used
3
IDs still free
4,091
Lowest free ID
1
Lowest free from 100
100
Valid: 10, 20, 30
Out of range: none
Duplicates: none
Largest free block: 31 to 4094 (4,064 IDs)
Planning conventions
| Range | Typical use |
|---|---|
| 1 | Default or native VLAN, present on every switch |
| 2 to 99 | First site: management, servers, IoT, guests |
| 100 to 199 | Second site, same segment names |
| 1000 and above | Reserved for voice, storage or replication VLANs |
| 4094 and 4095 | Top of the range. 4094 is the last assignable ID, 4095 is reserved. |
Frequently Asked Questions
What is the valid VLAN ID range?
802.1Q allocates 12 bits to the VLAN identifier, which allows 0 to 4095. In practice 0 and 4095 are reserved and the usable range is 1 to 4094. ID 1 is the default VLAN that exists on every switch even when nothing is configured, so treat it as the native or untagged VLAN rather than a free ID for your own use.
Why does my VLAN ID show up as invalid?
Either it is outside 1 to 4094, or it was written with a prefix or extra characters. IDs are 12 bits, so 4096 and anything above is out of range, and a value like vlan30 or 30/24 is not a number. Note that some switch interfaces allow a VLAN tag of 4095 in addition to the 4094 limit for tagging purposes, which is why the two limits are often quoted together.
How should I plan VLAN IDs across sites?
Pick a scheme and hold to it. Numbering per site, so Amsterdam management is 10, Amsterdam IoT is 20, and the second site starts at 110, keeps the ranges legible in a list and avoids two sites claiming the same ID for different things. Recording the intended meaning next to the ID, in the Terraform or RouterOS config where the VLAN is defined, keeps the map and the infrastructure from drifting apart.
Do I need to allow VLANs 1 to 100 on my firewall?
Only the ones you actually use. Most MikroTik and UniFi setups do not need a blanket rule for the first hundred IDs, and a wide allow rule is how unintended cross-VLAN access gets in. Create a specific rule per VLAN you route, as shown in the MikroTik VLAN filtering article.