CIDR to IP range converter

What this converts

A CIDR block such as 192.168.1.0/24 is shorthand for a run of consecutive addresses. The number after the slash says how many leading bits are fixed, and the rest can take any value. This converter spells the run out, from the first address to the last, so you can paste it into a firewall rule, an access control list (ACL), a cloud security group or any tool that wants start and end addresses.

How to use it

1. Paste your blocksOne per line, or separated by commas or semicolons, up to 1,000 in one go. A bare address counts as a /32, a block of one.
2. Read each rowYou get the first and last address, the exact count, the netmask and the wildcard mask, plus a warning about anything odd in the input. Under Other forms you also get the start and end as integers, and the reverse DNS zone when the block lines up with one.
3. Copy what you needTake the range for tools that want start - end, the wildcard for Cisco-style ACLs, or the count for capacity planning.

Range versus usable hosts

The range includes every address in the block, the network address (first) and the broadcast address (last) too. That is the right view for allow-lists and routing rules, where the whole block is covered. It is not the host range. For the first and last usable host, use the subnet calculator.

• Host bits set. 192.168.1.77/24 is accepted. The result shows 192.168.1.0/24 and tells you the address was rounded down to the start of its block.
• Netmask and wildcard. The netmask has ones for the network part, so for /26 it is 255.255.255.192. The wildcard mask is the reverse, with ones for the host part, so it is 0.0.0.63.
• Count. The size is 2 to the power of 32 - prefix, so a /22 has 2^10 = 1,024 addresses.

Common errors

• Prefix out of range. IPv4 prefixes run from /0 to /32. /33 is rejected.
• Leading zeros. 010.0.0.1 is ambiguous, because some software reads it as octal, so it is rejected. The message shows both readings.
• A range instead of a block. 10.0.0.1 - 10.0.0.9 is not a CIDR block. This page rejects it and points you to IP range to CIDR.
• An IPv6 block. Lines from the other IP family are reported as errors, line by line. Use IPv6 CIDR to range for those.
• Spaces in the block. These are forgiven: 10.0.0.0 / 8 and 10.0.0.0 255.0.0.0 are both read as 10.0.0.0/8.
• A mask instead of a prefix. 10.0.0.0/255.0.0.0 is read as 10.0.0.0/8, and a wildcard such as 0.255.255.255 is understood too, with a note in the result. A value that is neither a valid netmask nor a valid wildcard, such as 255.0.1.0, is rejected. The subnet calculator shows the prefix and wildcard for any mask.

How it works

The address is read as a 32-bit integer. The mask is that many leading ones, the first address is the integer ANDed with the mask, and the last is the first ORed with the inverted mask. Counts are whole numbers, never rounded. The conversion runs on our server from the text you submit. It is not written to logs and is held in memory for at most a day. On the website, Google Analytics also records what you enter, as the privacy policy explains.

# The same maths in Python, for checking
python3 -c "import ipaddress as i; n=i.ip_network('10.0.0.0/22'); print(n[0], n[-1], n.num_addresses)"

The standards behind it are RFC 4632 (CIDR, which replaced classful addressing), RFC 950 (subnetting) and RFC 1519, the 1993 original that RFC 4632 superseded.