Help:
This is a basic help document for EduNetworkBuilder.  You can get to this by going to "Help" -> "Help" from the main network-builder window.  Or, if you are working on a puzzle, the number buttons on the right-side should open context help.  (Help topics that somehow relate to the specific puzzle).
Overview:
EduNetworkBuilder is meant to represent, fairly truthfully, how a network functions while removing the complexity of configuration.  It focuses on IP addresses, Netmasks, Gateways, and Routes.  Because those concepts lead into others, it also helps teach wireless, DHCP, some firewalling, and VLANs.
The Items & Terminology:
The items in this are broken into three main portions.  Devices, network cards, and interfaces.  This is how Linux does it, and Windows does too, though it is hard to notice it.
A device is the physical object.  A laptop, desktop, server, etc.
Different devices can have multiple network cards.  Each card has a MAC (Ethernet) address.
Each network card can have multiple IP addresses.  This allows you to have one network wire coming into a computer, but have multiple IP-addresses.  This adds a little bit of complexity, to it being a "simple" network simulation tool.  But it adds a lot of flexibility, as well as being closer to reality.
Building a network:
Use the item list on the left to choose an item to add to the network.  Click on an item to select it.  Then click somewhere on the network to place it there.  You may put as many of those items on the network as you want before clicking on something else.
The arrow box will never add anything.  Use this button when you want to drag existing items around, or just select items to edit without the threat of accidentally adding another item to the network.
If you click on an item that is already on the network, you can drag it and release it to a new location.  There is no visual feedback that shows that you are dragging and dropping it.  When you release the button, the item will snap to the new location.
Links:
Click on the link button, then left-click on the starting item and drag to the destination item.  Release the button on the destination and a "link" box will appear.  Select the network-cards and interfaces that are selected.
Configuring The Devices:
Double-click an item to edit it.  You can change the host name, and add network cards and interfaces.  You can also set the default gateway and add routes.  On servers, you can configure the DHCP service.
Network Cards:
A network card is the thing that connects the device to the network.  There are many different types of network cards.  Ethernet (wired), Wireless, VPN (virtual network cards), and a number pf other ones.
Different devices can have one or multiple network cards depending on the nature of the device.  Each network card has a unique MAC (Ethernet) address.
Each network card can have multiple IP addresses (each IP address is assigned to an "interface".  This allows you to have one network wire coming into a computer, but have multiple IP-addresses connected to that one wire.  This adds a lot of flexibility for things such as firewalls and routers.
For the most part, you should not need to add extra network cards.  But, if you want to, you can by pressing the + button.  If you press the edit button on a network card, you can choose if the network card is configured statically or DHCP, you can configure the VPN settings, and a few other items.
Interfaces:
You change an interface when you are editing a device.  If the device has multiple network cards, you need to select the network card you want to change the interface for.  The interface initially looks like: "0.0.0.0 - 0.0.0.0"  This is the network and subnet.  The whole object of the program is to simulate what happens when you have different values here.  Or to have someone set up a network and then for you to go in and configure it so it works.  Double-click on an interface to set the IP Address and netmask for that interface.
Default Gateway:
The default gateway is on a device editing screen at the top-right.  Click on the button to set it.  If a Network Card is set to use DHCP then any value you put in will be overridden if the device does a DHCP Request.
ACTIONS:
You can right-click a device and do actions on it.  Delete, edit, ping from, arp from, dhcp request (if the device is configured to use DHCP), remove links between devices, and a few other things.
Packets:
A packet is information that is sent from one computer to another.  In this simulation, you can see the packets flowing between devices.  A packet has a source and destination.  Each packet looks different from the others.
The Ping packet goes from one computer to the other.  When it gets to the destination, the destination computer sends a ping response that says, "the ping made it."
The ARP packet (see the section on ARP) is used when one computer is looking for the MAC address of the other computer.  You usually do not see these packets in this simulation unless you specifically ask a machine to find the arp of another.
DHCP packets contain IP address information (See the section on DHCP or DHCP Servers).  They are used when a device needs to find its own IP address.  A DHCP server will respond with a packet to tell the device what IP address it should use.
A VPN packet is an encrypted packet (see the section on VPNs) that goes between two firewalls that are configured for a VPN.
A Tunnel packet is like a VPN packet, except it is not encrypted and anyone can read the information found in it.
Solving Puzzles:
Under the menu-item, "Samples", you will find the puzzles.  Opening this window will let you select from a number of puzzles which will help you learn how the program functions and test your knowledge of networking.  The puzzles start with a low complexity (level zero is mainly about basic usage of this program) and work their way up.  Starting at the beginning is recommended, but you can jump to whatever complexity you want to master.
As you try to solve a puzzle, you should see a series of radio-buttons on the upper-right.  These are your "help-o-meter."  Help of zero, the bottom, does not do anything for you.  If you click it up one button, it will color-code the machines that have problems.  If you click it onto the third button, it will give you a little more information about the problem when you mouse-over the problematic computer.  And the top-most button will basically tell you what you need to do when you mouse-over the problem.  Some puzzles, however, are set up to not show you the complete solution, and so you will need to think those out.
Making Puzzles:
EduNetworkBuilder is set up so you can make puzzles to give to others to do.  Start by thinking out your problem, what you want to solve and how you want them to solve it.  Then, draw your "network" by adding all the pieces.  Once all the pieces to the puzzle have been added, positioned and configured to your liking, you need to go to "Edit" and "Options."
Start by giving the puzzle a good name (title).  This shows up at the top of the network window.  You can determine if the device names and their IP addresses are displayed by checking the "Display Titles" checkmark.
Set the "Message given when network loaded", which explains the puzzle.  Make sure to give enough information that they can understand what you want them to do with the puzzle.  You can use ctrl-enter to add a new-line (since enter, by itself, closes the options window).
In the "tags" box, you can select the networking help topics that you want available for the player.  These will show up along the side of the networking box.
Finally, double-click in the "tests" box, or right-click to "add" a test.  Choose the device that is affected.  The source device is the one that will change color to tell you that there is a problem with it.  There are many sorts of tests, from needing to ping something, to have an IP-Address which is considered "local" to something else.
You can also choose to "lock" things.  This keeps others from changing them during the puzzle.  For example, locking pc0 NIC 192.168.1.3 will keep people from changing the network card that has the IP address of 192.168.1.3.
Levels:
Level_0:  Program operation.
Level_1: Basics: IP Addresses, Netmask, Gateway, Ping, etc.
Level_2: Firewalls, VPNs, etc.
Level_3: Troubleshooting the basics
Level_4: Advanced Subnetting and Routing
Level_5: Wireless
NETWORKING TOPICS:
The Basics:
There are four main components to subnetting.  The IP Address, the netmask, the default gateway, and static routes.
The IP Address:
The IP Address is a set of four numbers, connected by periods.  Each of the numbers is eight bits long, which means it is a number between 0 and 255.  On any network, each IP Address should be unique.  The IP Addresses should also be "local" to the other IPs next to them.  The Netmask is what determines if an IP address is considered local.
Most IP addresses are "public" and are reserved for specific people, places, and things.  These reservations are managed by various "registrars" on the Internet.  But there are three main sets of "internal" IP addresses that are set aside for use behind firewalls.  10.x.x.x, 192.168.x.x, and 172.16-31.x.x  We will be using these "Private" IP Addresses in this simulation.
The Netmask:
The network mask (or netmask) is a set of numbers that state what is considered "local" and what is considered "remote."  Anything that is not considered local is sent to the computer specified by the "default gateway."  Anything that is considered local is sent straight out to the local network, destined to the local machine.
The netmask usually looks something like 255.255.255.0.  In binary, this looks like: 
11111111.11111111.11111111.00000000
Again, each bit can either be 0 or 1, and a byte is 8 bits in length.  There are 4 bytes in each IP address, and the same number in each netmask.  The 255 number is the highest number that can be represented in one byte.  All the bits are set to 1.  
A netmask can also be expressed by "CIDR" notation.  This is a count of how many 1s there are in a row before the first zero.  The number above would be expressed as /24.
The Gateway:
The gateway is a computer on the same subnet as the IP address, where any non-local packets are sent to.  The computer compares the destination IP address with the local computer's IP address, using the subnet-mask to determine if it is local or not.  If the packet is local, it is sent straight out of the network card to the destination computer.  If the packet is not local, it is routed to the default gateway, which sends it on towards the final destination.
DHCP:
DHCP is a protocol for when a computer does not have a static IP address set up for it.  Often when a computer turns on or connects up to the wireless, it needs to have one assigned to it.  DHCP is what happens.  Basically the client broadcast out a "DHCP" request.  The request only goes out to "local" computers (it stops when it hits a router).  A DHCP Server will respond (if one exists on the local network) and give the client an IP Address.
DHCP Server:
(See DHCP above) A DHCP server remembers all the clients that request IP addresses so it issues the same IP address if that particular client asks a second time.  It also remembers which IP addresses it has given out so it does not give the same IP address to different computers.
Ping:
A Ping is a simple packet that is sent from one comput to the other.  The computer you send the ping packet to will usually respond.  The word "Ping" comes from the concept of a submarine and sonar.  Something does a "Ping" and you hear an echo to tell you that the computer is alive.  This is usually what it is used for, to determine if a computer is turned on, functional, or to see if the network is properly set up.
MAC Addresses:
Each Network Card has a hard-coded "address".  These are supposed to be unique to each network card, and look something like: 10:08:b1:73:aa:5b.  Packets that are being sent on the local network use the "Ethernet protocol", which sends the packet from one MAC Address to another.  
ARP:
ARP stands for "Address Resolution Protocol."  Computers on a local network talk to each-other by using the MAC Addresses.  
ARP is what is used when one computer wants to find the MAC address of another computer.  It usually sends out a broadcast that says, "who has this IP Address?"  And it gets a response back that says something like, "I have that IP and my MAC address is: 10:08:b1:73:aa:5b"
We do not get into it too much on this program, but if a computer does not know the MAC address of the computer it is trying to communicate with, it first sends out an ARP request to find that before it sends out a packet containing the ping or other communication.
You can usually run: arp -a
from a commandline to see all the MAC addresses that the computer has remembered.
Unicast Packet:
A Unicast packet is a packet that is going to one specific computer.
Broadcast Packet:
A broadcast packet is one that is sent out to everything that is considered local to it.  Routers, firewalls, and some other devices do not pass broadcasts on.
Static Routes:
A static route has a network, a subnet mask, and a gateway.  The gateway must be local to the computer that is sending out the packet, otherwise the computer cannot figure out how to send the packet.  Static routes are used primarily for telling routers, firewalls, and computers how to send packets when the IP addresses and gateways are not obvious.
Comparing IP addresses:
When a computer wants to compare IP Addresses, it does it by using the subnet mask.  A mask hides something.  A Halloween mask hides our face; masking tape covers a wall to keep it from being painted on.  A subnet mask hides the subnet.  For example, an IP address of 192.168.0.50 and netmask of 255.255.255.0 looks like:
IP:
11000000.10101000.00000000.00110010
Mask:
11111111.11111111.11111111.00000000
The mask has 24 ones in a row.  So it could also be represented as /24.  When it is compared, the first thing that happens is the subnet is masked out.  In the mask, the final set of numbers are zeroes.  The numbers where the mask is a 0 is dropped.  The resulting number is: 192.168.0.0.  This is called the "Network Address."  We do the same thing for both the source and destination IP.  Then we compare the Network Address of both of them.  If they have the same network address, then they are considered to be on the same network.  If they do not have the same network address, they are considered to be on different networks.
VPNs:
A VPN stands for a "Virtual Private Network."  It is used to make a secure connection between computers or networks, usually across the Internet.  It is usually used in the context of either someone working from home and wanting to access printers or file-shares off the office network.  Or, two different networks wish to be connected (two offices in different states, etc).
A VPN has an IP address, which is defined like any other IP address.  That IP-Address should be on a subnet that is unique to the VPN (such as 192.168.50.1).  The VPN also has a VPN endpoint.  The endpoint is the external IP address of the firewall that has the other end of the VPN.
The VPN also has an encryption key.  This encryption key is supposed to be hard to guess, and it is must be the same at both ends of the VPN.  The key is case-sensitive.
DEVICES:

Hubs:
A Hub is a very simple networking device.  When a packet comes into a hub, the packet is sent out of the rest of the network wires (links) attached to it.  The packet is not sent out of the wire that it came in on.

Switches:
A switch is like a hub, except that it has some brains to it.  A packet coming into a switch is sent out only to the destination it was intended to go to.  The first time a packet comes to a particular destination, the switch needs to figure out where that destination is.  So the first packet is sent everywhere.  When the destination responds, the switch now knows where the destination is, so the packet is only sent out that one port from then on.
The switches in this simulation have some features of a "managed switch", in that they pretend they have spanning tree turned on.  Spanning tree helps if you have a network loop (see the network loop puzzles for an example of what happens.)  Spanning-tree finds the quickest path through a series of switches from source to destination, ignoring the other paths.
Routers:
A router is a network device that recieves a packet and sends it onward to the next destination.  You may need to configure the routes on the router (see the topic on Static Routes).  It will have some basic routes set based on the interfaces configured on the device.  Anything that is considered "local" has a basic route defined for it.
Firewall:
A firewall has some ports that work as routers, but it can also have WAN ports.  A WAN port does not allow incoming packets.  Anything coming into the firewall that is destined for inside the firewall is blocked.  In a real firewall, you would have the option to do port-forwarding, which would allow incoming traffic to go to a particular destination.  We do not have any way to communicate between devices except "ping", which we usually do not port-forward for.  So this simulation does not do port-forwarding.
The firewall can also do VPNs (see the help topic on VPNs for more information).  The VPN allows devices behind one firewall to talk to devices behind another firewall.
Wireless Router:
The wireless router is the most complex device on the network.  It functions as a firewall, as a switch (on the wired side) and as a hub (on the wireless side).  It has VPN capability and can serve DHCP.
Wireless Access Point:
The WAP (Wireless Access Point) is a simple device, which allows you to plug one Ethernet port into a wire, and attach multiple wireless devices to it.  Read up on General Wireless for more information on how to configure it.  
Wireless Bridge:
A Wireless Bridge is the opposite end of a Wireless Access Point.  It has one wireless client connection, to connect to something that serves a wireless signal, and a built in Ethernet switch to connect to the wired connections.  It goes at the far end of a wireless link, and allows you to attach multiple wired devices.  The Wireless Bridge is also called Wireless Client Mode (when referring to wireless devices.)
Wireless Repeater:
Wireless has a limited distance it can travel, but sometimes you would prefer to stretch the wireless out farther.  A wireless repeater has a wireless client connection, which connects it to a wireless server, and it has a wireless server, which allows you to attach other wireless clients to it.  When you are rolling out wireless in a building, it is important to realize that wireless repeaters are usually a bad idea.  Each wireless access point usually has a maximum capability for the amount of data it can transport.  Adding a repeater does extend the distance and increases the number of devices that works on the one wireless antenna.  Everything sent from the repeater gets sent up to the parent antenna, which means the parent antenna has that much more bandwidth used. 
Packet Corruption:
There are a number of things that can cause packets not to successfully get from one side of the network to the other.  Even if your routing is fine, you may have problems with packet corruption where some packets drop but some get through.  With Internet packets, this is often due to using too much bandwidth.  But if it is on your own network, you should check your managed switches to see if you have a lot of errors on the links in question.  (This simulation does not have error counts.)
Bad wires will usually stop a packet in its tracks, though sometimes they will only corrupt packets when you have enough traffic.  
If a network wire runs too close to electrical cables for too long, the electricity going through the cables will bleed over into the network wires, which can cause a lot of packets to drop on that link.
Network wires running too close to fluorescent lights can also get corrupted.  Again, it is the pulsing of the electricity that can cause bleed-over into network cables.
General Wireless:
A wireless connection uses an antenna in both the client and server to connect the two using a radio signal.  To secure the connection, it uses a name (the SSID) and a password (the wireless key) which much match.  
Wireless works the way a hub works instead of working like a switch.  A switch figures out which wire a particular computer is attached to, and it sends the packet only to that one computer.  A wireless device does not have individual wires connecting to the different computers.  Instead, it broadcasts out the signal on the radio channel, and all the individual computers listen to the packet to determine if it is for them.
The problem with this, is that it affectively divides up the bandwith between the devices connected to the network.  For example, if you have a 54 MBps wireless G device with 10 devices connected to it, each device gets roughly 5.4 MBps.
A wireless repeater extends the wireless signal, but it mainly adds more people to one antenna.  So instead of 10 devices on the one wireless, you now have 20.  That divides up the signal farther, breaking up the 54 MBps to 2.7 MBps per person.
Wireless adds latency to each link.  Some of that is due to the fact that most wireless devices use encryption to secure the device.  There is some overhead in encrypting and decrypting the packet, particularly since the access-point has a pretty wimpy CPU.  The amount of latency depends a lot on the quality of the wireless equipment.  Many people use small home/office (soho) equipment for their wireless networks until they realize the amount of pain those can impose on a larger network.  Better, big name-brand equipment (HP, Cisco, etc) makes a huge difference in the amount of latency, as well as being able to manage in bulk.  Intermediate equipment (like Ubiquiti) has a pretty good mix of good price and better quality.  
Many devices have MIMO (Multiple Input, Multiple Output) antennas.  This usually allows you to work on two channels simultaneously.  Without MIMO, a wireless device can only function on one channel at a time.  What this usually means is that, if one wireless G device connects to a wireless N (150 MBps) access point, everything on that access point switches to the lower speed of wireless G.  The MIMO antennas allow you to be running one network on N while the other runs on G.
Wireless SSID:
The wireless SSID (Service Set Identifier) is basically the name of the wireless connection.  Advanced devices can have multiple SSIDs on one access-point (this simulator does not allow for that).  The SSID is usually public information which is broadcast out from the device.  You need to specify the key when you connect to make sure you have permission to access the network.
Wireless Key:
The wireless Key is a password for accessing the particular SSID that the key is associated with.  The key is used in encrypting packets between the device and the wireless Access-point.
ADVANCED TOPICS:
Subnetting:  (Based heavily off of LordFlasheart's post, "Subnetting Made Easy" here: http://www.techexams.net/forums/ccna-ccent/38772-subnetting-made-easy.html
An IP address is made up of 32 bits, split into 4 octets (octet = 8 bits). Some bits are reserved for identifying the network and the other bits are left to identify the host.
Below shows you how, for each class, the address is split in terms of network (N) and host (H) portions.
NNNNNNNN.HHHHHHHH.HHHHHHHH.HHHHHHHH /8
NNNNNNNN.NNNNNNNN.HHHHHHHH.HHHHHHHH /16
NNNNNNNN.NNNNNNNN.NNNNNNNN.HHHHHHHH /24
There is a boundary at each dot, therefore there are boundaries after bits 8, 16, 24, and 32. This is an important concept to remember.  The first move in doing any work with subnets is to figure out which boundary segment you are working within.  So you will need to remember the 8, 16, 24, 32.
We will either be working with the netmask given in CIDR notation (/24) or in dotted decimal (255.255.255.0).  The first thing to do is to determine the block size: how big the subnet is.
With CIDR (/24) we do this by first finding the nearest boundary higher than our number.  For example, we are using a /20 subnet.  The next boundary up is /24.  We then subtract our subnet from the boundary.  24 - 20 = 3.  There are three bits that make up the size of the subnet.  the number of numbers in 3 bits = 2 ^ 3 (two to the power of 3, or 2 * 2 * 2), which is 8.  Remember that the first number is lost to the "network address" and the last number is the "broadcast address".
It is very simple to determine the block size when using the dotted decimal (255.255.255.0) format.  You find the last number that is not 255, and subtract it from 256.  For example, if you are doing 255.255.255.240, the last number is 240.  256 - 240 = 16.  So the block size is 16.  But, what do we do with the block size?  Well, the easiest thing to do is to look at a number of examples, and it should make more sense.
Question:  What subnet does 192.168.12.37/29 belong to?
You may wonder where to begin. We always start with determining which boundary we are working with for this address.
Our mask is a /29. The next boundary up is 32. So 32 - 29 = 3. Now 2^3 = 8 which gives us our block size i.e. 2 to the power of 3 equals 8. 
We have borrowed from the last octet as the 29th bit is in the last octet. We start from zero and count up in our block size. Therefore it follows that the subnets are:-

192.168.12.0
192.168.12.8
192.168.12.16
192.168.12.24
192.168.12.32
192.168.12.40
.............etc.
Our address is 192.168.12.37 so it must sit on the 192.168.12.32 subnet.

Question: What subnet does 172.16.116.4/19 sit on?
Our mask is /19 and our next boundary is 24. Therefore 24 - 19 = 5. The block size is 2^5 = 32.
We have borrowed into the third octet as bit 19 is in the third octet so we count up our block size in that octet. The subnets are:-
172.16.0.0
172.16.32.0
172.16.64.0
172.16.96.0
172.16.128.0
172.16.160.0
.............etc.
Our address is 172.16.116.4 so it must sit on the 172.16.96.0 subnet. Easy eh?
Question: What subnet does 10.34.67.234/12 sit on?
Our mask is 12. Our next boundary is 16. Therefore 16 - 12 = 4. 2^4 = 16 which gives us our block size.
We have borrowed from the second octet as bit 12 sits in the second octet so we count up the block size in that octet. The subnets are:-
10.0.0.0
10.16.0.0
10.32.0.0
10.48.0.0
.............etc.
Our address is 10.34.67.234 which must sit on the 10.32.0.0 subnet.
Hopefully the penny is starting make sense. We will now change the type of question so that we have to give a particular host range of a subnet.
Question: What is the valid host range of the 4th subnet of 192.168.10.0/28?
Easy as pie! The block size is 16 since 32 - 28 = 4 and 2^4 = 16. We need to count up in the block size in the last octet as bit 28 is in the last octet.
192.168.10.0
192.168.10.16
192.168.10.32
192.168.10.48
192.168.10.64
.................etc.
Therefore the 4th subnet is 192.168.10.48 and the host range must be 192.168.10.49 to 192.168.10.62, remembering that the subnet and broadcast address cannot be used.
Question: What is the valid host range of the 1st subnet of 172.16.0.0/17?
/17 tells us that the block size is 2^(24-17) = 2^7 = 128. We are borrowing in the 3rd octet as bit 17 is in the 3rd octet. Our subnets are:-
172.16.0.0
172.16.128.0
The first subnet is 172.16.0.0 and the valid host range is 172.16.0.1 to 172.16.127.254. You must remember not to include the subnet address (172.16.0.0) and the broadcast address (172.16.127.255).
Question: What is the valid host range of the 7th subnet of address 10.0.0.0/14?
The block size is 4, from 16 - 14 = 2 then 22 = 4. We are borrowing in the second octet so count in the block size from 0 seven times to get the seventh subnet.
The seventh subnet is 10.24.0.0. Our valid host range must be 10.24.0.1 to 10.27.255.254 again remembering not to include our subnet (10.24.0.0) and the broadcast address (10.27.255.255).
What if they give me the subnet mask in dotted decimal?
If you're lucky and they give you a mask in dotted decimal format then you should have an even easier time. All you need again is your block size.
Let's say they have given a mask of 255.255.255.248 and you wish to know the block size. Here's the technique:
1. Starting from the left of the mask find which is the first octet to NOT have 255 in it.
2. Subtract the number in that octet from 256 to get your block size e.g. above it is 256 - 248 = block size of 8.
3. Count up from zero in your block size in the octet identified in step 1 as you have learned above (the example above would be in the last octet).
Another example is a mask of 255.255.192.0 - you would simply count up in 256 - 192 = 64 in the third octet.
One more example is 255.224.0.0 - block size is 256 - 224 = 32 in the second octet.
WHEN TO SUBNET:
The word, "subnet", means one network that is part of another.  The process of subnetting, therefore, is the process of breaking a network into smaller pieces.
Subnetting used to be very critical to the smooth operations of a network.  Old versions of Windows did lots of broadcasting, and networks were very loud.  That, combined with slower networks, meant a lot of congestion.  To remedy that, they used to subnet networks into small pools of like items (PCs, printers, servers, etc.)  This would have the net effect of shrinking the distance a broadcast packet would travel, as well as give granular control of security.
But a number of technological advances happened, which removed many of the reasons to subnet.
* Switches were invented so only broadcast traffic went to every machine.
* Protocols got a lot smarter, relying less and less on broadcast traffic to make things work.
* Programs got a lot smarter, using other methods than broadcasts.
* Router speed increased, so routers could handle more traffic and larger routing tables.
* Network speeds increased exponentially, which increased the carrying capacity of a single network exponentially.
* And many other advances.
So, in short, subnetting is no longer critical for making a small network function.  But subnetting of large networks is very important.  Security is probably the biggest reason to subnet.  Subnetting very large networks can still be very helpful in keeping down traffic.  And Subnetting networks that are connected via VPNs is still a very important part of planning large scale networks.
There are a few main rules for how to subnet:
* All IP subnets should use natural boundaries.
* Grouping like objects into “natural” subnets makes them easier to control.
* Smaller adjacent subnets should fit into larger subnets, most of the time.
* Smaller routing tables require less management and resources.
All IP subnets should use natural boundaries.
Even if you do not need all the space, you should break up networks into ranges of the power of 2.  It is very common to say something like, the first 50 IPs are for networking equipment, the next 20 are for printers, etc.  But it is much better to use 64 IPs for networking equipment, and 16 IPs for printers...  The numbers are not quite as simple on the brain, but they are a lot easier to control in your firewall.  You can block access from the Internet to your networking equipment my making one simple rule if you make your ranges appropriately.  You should also plan on growth.  It is very common for people to run out of their IP space, simply because they failed to plan.
Grouping like objects into “natural” subnets makes them easier to control.
As mentioned above, it is common to want to block Internet access directly to and from your networking equipment and printers.  You may want to allow certain traffic to individual departments (many organizations allow the media departments to access Facebook and social media sites during work-hours, while other departments are not allowed to access those same sites.)  If your equipment and PCs are subnetted along natural boundaries (8, 16, 32, 64, etc.), you can usually make a single rule to allow or block traffic to those particular items.
Smaller adjacent subnets should fit into larger subnets, most of the time.
If you plan it right, you should be able to supernet your subnets, and have one route or rule for them.  For example, you may have your networking equipment in 1-63, and your printers from 65-127.  That means you can have one route or rule that matches all 128 IPs.  This makes life a lot simpler for creating many sorts of rules.
Smaller routing tables require less management and resources.
Again, with the onset of more powerful routers, firewalls, and faster networking speeds, this is no longer quite as critical as it once was.  But if you have a finely tuned firewall, you can end up with many rules.  Often it is very nice to block all access to a whole range instead of blocking access to each machine one IP at a time.  Often, the "less management" simply means less work for the techies who are keeping things running smoothly.

VLANs:
Most managed switches can be configured for VLANs. Virtual Local Area Networks (Virtual LANs) allow you to segment your network for security sake.  Any computer, or device, that is on one VLAN can communicate with anything else on that VLAN.  If it is not on the same VLAN, you need a router to route the packets between VLANs.
For example, in this image, there are multi-colored computers.  Each color represents. A VLAN.  The purple computers can talk to each-other, the yellow computers can talk to each-other, and the green computers can talk to each-other.  But, for the green computers to talk to the yellow computers, the packet must go through the firewall.
The firewall lets us set up rules to allow, or disallow packets to go between VLANs.  In this way, you can have a staff network, which is protected from the guest network.  Your server is something that you do not want strangers to have access to.  But, you could have a printer on the guest network, which the staff could use.
To make this work, you need to define your VLANs.  The VLAN is only really tracked by the “VLAN ID”, a number.  But, since it is often hard for us to remember the numbers, we can define a name for each VLAN Id we want to use. 
EduNetworkBuilder also allows us to define a color for each VLAN.  This color is used when visualizing packets; the packet has a ring of the VLAN color around it if the option is set for the puzzle you are working on.
Once we have defined the VLAN IDs and names, we can then program our Switches.  We do that by setting each port / VLAN combination with one of three values:  Tagged , Untagged, or Forbidden
All data being processed by a switch is “tagged” by the switch, so the switch knows where it came from.  Behind the scenes, the switch is tagging and untagging all the time.  When you only have the default VLAN, you never notice it.
These names end up confusing people a lot.  They represent the status of the packet that is expected on the port that it is plugged into.  For example, if we have port 1 untagged on the “default” VLAN, it means that we expect any packed that is coming in from port 1 to need to be tagged as it enters the switch.  Let’s return to that in a moment.  First, let’s look more at the definition of what these mean.
Untagged:
You can only have one “untagged” VLAN per port.  It means that, when an untagged packet comes into the switch, that packet needs to be tagged with the VLAN ID of the specified VLAN so the switch can track where it comes from.  For example, if you have port 1 untagged on VLAN 10, then, when a packet comes into the switch, the switch will mark it (tag it) as being part of VLAN 10.  When the packet leaves the switch out of that port, if the packet is part of VLAN 10, the packet is untagged as it leaves. 
If you have a computer or a device that does not know about VLANs, you need to have it plugged into a port that is “untagged.”  Computers and unmanaged devices only know how to produce untagged packets, and so the switch needs to know how to deal with untagged packets.  If a packet comes in that is untagged, and no VLAN is labeled as untagged, then the switch does not know what to do with the packet, and the packet is dropped.
Tagged:
If a packet is tagged, it means the packet is expected to be coming from another switch, or a device that understands VLANs.  Only VLAN-knowledgeable devices can tag a packet, so they must be coming from a VLAN capable device. Tagged packets are ones which are destined for a device on another switch, or need to be routed to another VLAN.  The VLAN Tag tells the switches at the far end, which VLAN the packet is a part of.  Most of your switch-to-switch traffic should be tagged.  And, when you tag a VLAN, you will usually tag it for all VLAN IDs that you have.  There will be some cases when you will not want it tagged for everything, you want to forbid it (below)
Forbidden:
Forbidden VLANs allow you to keep certain VLANs from being accessed in different places.  For example, if you have a school that has a staff network, guest network, and a student network, you may not want the staff network accessible in the student dorms.  If the network is forbidden there, then the students cannot hack into it from there without going through your firewall.  There are a number of ways to hack into VLANs, and so there are certainly some times to forbid VLANs from places where they do not need to be.
Configuring a VLAN: 
Let’s look at this example of vlan configuration.  Here we have four VLAN IDs.  The main networks we have are for student, staff, and guests.
Port 1 is “Untagged” on the Student VLAN.  This means that the computer connected to port 1 is part of the Student VLAN.
Port 2 is untagged on the default VLAN.  This is actually not good practice.  The default VLAN is often used for switch-to-switch communication, and giving people access to this is a great way to be hacked into.
Ports 6 and 7 are Tagged for all the VLANs.  These are the uplink ports for the switch that connect to the other switches, or to the firewall.
Below are some best practices for VLANs
VLAN Best Practices: 
Use ports on one side of switch or other for uplinks (tagged)
This is for convenience of management.  If all your uplink ports are on one end of the switch, it makes it a LOT easier when moving wires around.  It is very difficult, if you have uplinks somewhere in the middle of your switch, to remember which wire connects to a switch and what connects to a computer.  If you have a very complex network, where you have multiple ports on every switch that are untagged for different VLANs, then it may not matter as much. You will be needing a very thorough network map to do that.  But, for the most part, use your uplinks on the left (that is where most switches that have special “backbone” ports have them.)
Management VLAN is untagged on uplink ports.  
EduNetworkBuilder drastically limits your ability to have complex tagging and untagging.  Some switches allow you to build things that cannot physically work.  EduNetworkBuilder does not allow some of that.  Unfortunately, it also keeps you from doing one of the best practices.  On your uplink ports, the ports that connect from switch to switch, you should usually have the management VLAN untagged.  This makes life a lot simpler when you are trying to access switches for the first time.  But, not all switches allow you to combine tagged and untagged ports.  It is just very nice when you can do so.
Block the default vlan on all ports except switch-to-switch ports
The default port is used for switch-to-switch communication.  There are hacker tools which allow hackers to create packets to fool switches into doing things, so long as those packets come in on the default VLAN.  Thus, the default VLAN should be blocked on all ports that hackers might use, but need to be allowed on the ports which are connected to other switches.
Create a management vlan that is separate from the default VLAN
He who controls a switch, controls most of the network.  Because of this, it is best to create a VLAN for managing switches that is separate from your other VLANs.  In particular, the default VLAN is the dangerous VLAN to have access to, so it is pretty important to do your management on something different from that.  But, if you have the choice between using the guest VLAN and the default VLAN for management, use the default VLAN.  But if at all possible, do your management from its own network and control access to that VLAN using firewall rules.