How to Isolate Workgroups Using an IP Mask

Decide on the number of hosts that you need within each workgroup. It is best if the workgroups are approximately the same size.

Determine the IP Class type of your IP address range. If the first octet of the network IP address range is between 1 and 126, then the IP Class type is Class A. If the first octet of the network IP address range is between 128 and 191, then the IP Class type is Class B. If the first octet of the network IP address range is between 192 and 223, then the IP Class type is Class C.

Look at the chart in the Pantz Internet Protocol (IPv4) Subnet Chart (see Resources) that corresponds to the IP Class type of your IP address range. Find the number in the "Number of Hosts" column that is slightly greater than the workgroup size determined in Step 1. If the number listed in "Number of Subnets" in the same row is equal to or greater than the number of workgroups you need, then note the subnet mask listed in the "Subnet Mask" column. If not, find the number in the "Number of Subnets" column that is equal to or greater than the number of workgroups needed, and note the subnet mask listed in the same row.

Determine the IP addresses per workgroup using a subnet calculator (see Resources). In the subnet calculator, select the IP Class type of your IP address range. Then enter the IP address octets into the "IP Address" fields that have a "255" in the corresponding subnet mask and type "0" for the remaining octets. Then type or select the subnet mask determined earlier and press the "Enter" key.

Note the "Host Address Range" displayed in the calculator, as that is the host address range of the first workgroup. Increment the last octet of the last IP address displayed in the host address range by 2 and enter the result in the "IP Address" fields and press the "Enter" key. Note the "Host Address Range" displayed, which is the host address range of the second workgroup. Repeat to find the IP address ranges for all workgroups.

Assign each workgroup host an IP address that is within the IP address range for the workgroup to which the host belongs. Assign each workgroup to one VLAN within the network infrastructure.

Source.