CIDR aggregator

What the aggregator does

Firewall allow-lists, block-lists and route tables grow by copy and paste. Over a few years one list ends up with duplicates, a /24 next to the /25 that is already inside it, single addresses that could be one block, and ranges nobody wrote in CIDR form. This tool reads the whole mess and gives back the smallest set of CIDR blocks that covers the same addresses.

It reads one entry per line in any mix of notations: a single address such as 203.0.113.10, a block such as 10.0.0.0/24, a range such as 10.0.3.0-10.0.3.255, an address with a netmask such as 198.51.100.0 255.255.255.0, and IPv6 such as 2001:db8::/33. Text that was defanged for safe sharing, like 10[.]0[.]0[.]1, is read as the plain address.

Next to each result block you see how many entries fed it, and next to each entry you see the block it ended up in, so you can check the merge instead of trusting it.

Exact merge never adds addresses

In exact mode the result covers the same addresses as your list, no more and no fewer. Overlapping and touching entries join, and a block is only ever replaced by blocks that hold exactly its addresses. That matters for a firewall: a merge that quietly lets in addresses you never listed is a security change, not a tidy-up.

Exclusions and cover mode

The exclusion box removes ranges from the result. Allow 10.0.0.0/22 except 10.0.1.128/25 and you get 10.0.0.0/24, 10.0.1.0/25 and 10.0.2.0/23: the hole is cut out and the rest is written as the fewest blocks.

Cover mode is for when a short list matters more than precision. You choose the most blocks you can live with, and the tool joins the neighbours that add the fewest extra addresses until it is within your limit. It then says exactly how many addresses the list covers that you did not list. It never joins blocks across an address you excluded, and it treats IPv4 and IPv6 separately.

Read the extra-address count before you paste a cover result into a firewall. Four extra addresses in a /29 may be fine. Four million may not be.

Ready for your platform

Under More options, pick the format of the export: a plain list, nginx allow lines, ipset and iptables commands, an nftables set, an AWS WAF IP set as JSON, a Cloudflare list, a Terraform list or CSV. The export holds only the merged blocks, written the way that platform expects them. Check the limits of your own platform before you load a long list, because they differ by product and plan.

Where your list goes

With JavaScript on, the list is merged in your browser and nothing you paste is sent to us. Without JavaScript, the form sends the list to our server in the page address, which limits how long a list can be, and the server merges it. The API and the no-JavaScript form take about 4,000 lines (a 64 KB request). The browser takes up to 100,000. Our privacy policy has the details.