IP range to CIDR converter

Why a range turns into several blocks

A CIDR block has to start on a boundary that matches its size, so most ranges cannot be written as one block. Firewalls, cloud security groups, routers and blocklists speak CIDR. Registries, spreadsheets and threat feeds often publish ranges like 10.0.0.5 - 10.0.0.20. To bridge the two, the range is split into aligned pieces, and this page finds the fewest pieces that cover it exactly.

That table is the answer for 10.0.0.5 - 10.0.0.20: five blocks and 16 addresses, with no overlap and no extras.

How to use it

1. Enter a rangeWrite 10.0.0.5 - 10.0.0.20, 10.0.0.5 to 10.0.0.20 or the short form 10.0.0.5-20. Put one range on each line, up to 1,000 lines.
2. Read the listEach range comes back as its blocks in order. For a single range, you also see the first address, last address and size of every block, so you can check that nothing is missing.
3. Decide whether one covering block will doWhen a range needs several blocks, the page also shows the smallest single block that holds it, and how many extra addresses that block would let in. Use it only if a few extra addresses are fine.

Exact list or covering block?

Use the exact list for allow-lists and for anything where letting in an extra address would be a security problem. A covering block is shorter to write, but it is broader. For 10.0.0.5 - 10.0.0.20, the smallest single block that holds the range is 10.0.0.0/27. It has 32 addresses, 16 more than you asked for.

• The worst case. An IPv4 range needs at most 62 blocks. Most real ranges need far fewer.
• Aligned ranges collapse. 10.0.0.0 - 10.0.0.255 becomes the single block 10.0.0.0/24.
• Ranges that cross a boundary. 10.0.0.200 - 10.0.1.50 can't be one /23, because 10.0.0.0/23 would let in 405 addresses outside the range.

Common problems

• The start is after the end. Swap them. The page reports the order problem instead of guessing.
• A CIDR block instead of a range. A line like 10.0.0.0/24 is reported, with a pointer to the CIDR to IP range converter.
• IPv6 or mixed addresses. A range can't mix IPv4 and IPv6, and IPv6 ranges have their own page: IPv6 range to CIDR.
• Too many blocks for a rule limit. Cloud providers cap the rules in a group. Use the covering block if the extra addresses are acceptable, or merge neighbouring ranges before you convert.
• Registry ranges with odd ends. Old assignments (for example inetnum entries in registry data) are often not aligned to CIDR boundaries, which is why a short list of blocks appears.
• Gaps and overlaps between ranges. Ranges are not merged here. Convert each one, then combine the blocks afterwards.

How the fewest blocks are found

Starting at the first address, the page picks the largest block that begins exactly there and does not run past the end. It writes that block down, moves to the address after it and repeats until it reaches the end. That gives the smallest valid list, and it never needs more than 62 blocks. It uses whole-number arithmetic only, so nothing is rounded.

# The same maths in Python, for checking
python3 -c "import ipaddress as i; print(list(i.summarize_address_range(i.ip_address('10.0.0.5'), i.ip_address('10.0.0.20'))))"

To go from blocks to boundaries instead, use the CIDR to IP range converter. The standard behind it is RFC 4632 (CIDR), which replaced RFC 1519.