Help segmenting the network

Hi. It's my first time splitting a network, so hope you will help me. First I go with what I have, what I want and finally what I thought.

What I have:

Currently I have 5 permanent users, but when family gathers we can be easily between 6-12, and they like to use the network as theirs and come with a lot of devices that are unprotected and unprotectable. Currently we have 24 hosts, at least 5 pcs, 1 tablet, 6 smartphones, 2 consoles, 1 server(my server)[two NIC], 1 server(dns and bkp solution)[raspberry pi], 1 router[TP-link Archer C5] and the rest I don't know what are and I think I don't want to know. They all reside on same network. Only servers and my pc are wired, the rest use wifi.

What I want:

I want to give each user his own isolated network with his own and make it to use a different dns server, plus a few more isolated networks for servers and guests and test . No device must be able to talk in any way to another device outside his network (icmp ping, arp discovery, packet capture must be not allowed), with the exception of my pc that must be able to initiate communication with any other pc, and receive packets only on connections it initiated himself. Only one device will host are dns servers, so this device must be accessible to all networks. The devices pertaining a network are dynamic.

groups of devices that must be able to communicate between them:

Guest_net {...} 
Server_net_1 {SERVER_1, DNS_SERVER} 
Persnonal_net_1 {PC1, ...}, Persnonal_net_2 {PC2, ...}, ..., Persnonal_net_N {PCN, ...}
{PC1, PC2} {PC1, PC3} ... {PC1,PCN} [only must allow connections initiated by PC1 connecting to port 22]
{PC1, SERVER_1} {PC1, DNS_SERVER}
{DNS_SERVER, any_device} [only must allow connections on port 53]

What I thought:

To accomplish this I think I need both, VLAN and subnetworks. Since I don't know which device would pertain to each network, I think that creating a wifi SSID asociated to a vlan would be the best thing.

The network should be as follows:

Personal_net_N {
    SSID: "MY_WIFI_Personal_N", VLAN: "VLAN_(100+N)"
    VLAN: "VLAN_(100+N)"
    IP: 192.168.(100+N).0/24
    Devices: {
        [ROUTER(Gateway)]: 192.168.(100+N).1
        [PC_N]: 192.168.(100+N).10
        [any_device]: 192.168.(100+N).[11-200]
    }
}
Servers_ext_net {
    VLAN: "VLAN_5"
    IP: 192.168.5.0/24
    Devices: {
        [ROUTER(Gateway)]: 192.168.5.1
        [SERVER_1]: 192.168.5.30
    }
}
Servers_int_net {
    VLAN: "VLAN_1"
    IP: 192.168.1.0/24
    Devices: {
        [ROUTER(Gateway)]: 192.168.1.1
        [DNS_SERVER]: 192.168.1.10
        [DHCP_SERVER]: 192.168.1.11 (I don't know if I need it yet)
    }
}
guest_net {
    SSID: "MY_WIFI_Guest", VLAN: "VLAN_(100+N)"
    VLAN: "VLAN_10"
    IP: 192.168.10.0/24
    Devices: {
        [ROUTER(Gateway)]: 192.168.10.1
        [any_device]: 192.168.10.[11-200]
    }
}

Since I can not specify port on DHCP, option DNS. I think I would deploy multiple instances of pi-hole on DNS_SERVER localhsot:[10000-10255] and specify the following iptables on DNS_SERVER:

-t nat -A PREROUTING -p tcp --src 192.168.N.0/24 --dport 53 -j REDIRECT --to-port (10000+N)
-t nat -A PREROUTING -p udp --src 192.168.N.0/24 --dport 53 -j REDIRECT --to-port (10000+N)
-t nat -A POSTROUTING -j MASQUERADE
-A INPUT -p tcp -s 192.168.N.0/24 --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p udp -s 192.168.N.0/24 --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp -d 192.168.N.0/24 -j ACCEPT
-A OUTPUT -p udp -d 192.168.N.0/24 -j ACCEPT

Now problem is DHCP, how I make it to assign an ip from x pool to a device of y VLAN, it's say how do I map VLAN to DHCP pool?

If the router DHCP is not suitable and I need a standalone DHCP server, I only want to have a device serving DHCP, althoug it could have several DHCP servers. How I proceed? In this case I probably need to use dhcp relay, right? But still how map VLAN to DHCP server. Since they don't have ip yet I can not use the approach used for DNS.

For PC1 accessing 192.168.N.10:22, How I do this? I would need to make the router to act as a firewall too? I suppose that I wouldn't be able to put a raspberry to act as a firewall.

Finally, what router/ap (I know it's bad idea, but I prefer a all-in-one-box router if possible. I'm space constrained) can create "infinite" (or at least 15) SSID that would assigned to a VLAN? What router can act as a firewall too? In short, what is the router that would work for my use case? [A custom firmware is an option, but I prefer to keep the warranty.]

Help segmenting the network

comments