I can share my config with you, although… some call it overkill :o
I run pfSense in a Vmware ESX enviroment, and therefore have access to quite a few virtual NICs (which is nice for segmentation and VLAN purposes).
This is the vlan-config running inside vmware :
http://0o2471.net/15677
And this is what the physical cabling looks like :
http://0o2471.net/15653
The VLAN 200 is a isolated connection to my DSL-modem, incase I need things to have direct access (official IP's), and if I put a host in this VLAN it will get a DHCP from my ISP.
The VLAN 300 is my internal VLAN for regular connected laptops \ computers that I trust, I'm thinking of implementing a auth of some sort for this VLAN.
The VLAN 400 is my Wireless Guest network, the host connected here have no access to the internal network, but talk only to pfSense and the internet, there is also a captive portal here
The VLAN 500 is my Wireless internal network, where I myself and other trusted computer connect, same priveleges as VLAN 300, but this SSID is hidden and WPA2-protected, also my IP-telephone is on this network
The VLAN 600 is the management VLAN on which only managementstuff is, like the Switches, accesspoints and iLO of the servers
This is btw only my lab :P