CIDR to IP range
Expand any CIDR block into its first and last address, host range, mask and total count — for firewall rules, allowlists and audits.
- Runs in your browser
- Nothing you enter is sent
- Free, no account
| CIDR notation | 192.168.1.0/24 | |
| Subnet mask | 255.255.255.0 | |
| Wildcard mask | 0.0.0.255 | |
| Host range | 192.168.1.1 – 192.168.1.254 | |
| Mask in binary | 11111111.11111111.11111111.00000000 | |
| Network in binary | 11000000.10101000.00000001.00000000 | |
| Class | C | |
| Scope | Private (RFC 1918, 192.168.0.0/16) | |
| Integer range | 3232235776 – 3232236031 |
prefix /24 mask = 11111111.11111111.11111111.00000000 (255.255.255.0) address = 11000000.10101000.00000001.00000000 (192.168.1.0) AND = 11000000.10101000.00000001.00000000 (192.168.1.0) hosts = 2^(32 − 24) − 2 = 254
Expanding a block
A CIDR block is a starting address plus a prefix length. The prefix fixes the leading bits and every combination of the remaining bits is inside the block, so the range always begins at the network address and ends at the broadcast address.
| Block | First address | Last address | Count |
|---|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 | 10.255.255.255 | 16,777,216 |
| 172.16.0.0/12 | 172.16.0.0 | 172.31.255.255 | 1,048,576 |
| 192.168.0.0/16 | 192.168.0.0 | 192.168.255.255 | 65,536 |
| 100.64.0.0/10 | 100.64.0.0 | 100.127.255.255 | 4,194,304 |
| 169.254.0.0/16 | 169.254.0.0 | 169.254.255.255 | 65,536 |
The 172.16.0.0/12 case catches people out constantly. It ends at 172.31.255.255, not 172.16.255.255 — twelve fixed bits means the third nibble of the second octet is free, giving 172.16 through 172.31.
Address range or host range?
Both are shown above, and they are used in different places. A firewall rule, a route table entry or a security-group source wants the full address range including the network and broadcast addresses. A DHCP pool or a static-allocation plan wants the host range, which excludes both. Mixing them up leads to an allocation that overlaps the gateway.
Prefix lengths worth recognising
/32— exactly one address. The idiomatic way to name a single host in a rule./31— two addresses, both usable, for point-to-point links (RFC 3021)./30— four addresses, two usable. The traditional point-to-point size./24— the classic “one office LAN”./0— everything.0.0.0.0/0is the default route, and in a security group it means the entire internet.
Dotted masks are accepted too
Older equipment, and Cisco configuration in particular, writes the mask in full:
192.168.1.0 255.255.255.0. Type 192.168.1.0/255.255.255.0 here and it
converts. A non-contiguous mask such as 255.0.255.0 is rejected with an
explanation — a valid mask is always a run of ones followed by a run of zeros, which is exactly
what makes it expressible as a prefix length.
Wildcard masks are the other way round
Cisco access lists use a wildcard mask, which is the inverse: 0.0.0.255 where the
subnet mask would be 255.255.255.0. A zero bit means “must match” and a
one bit means “don't care”. The wildcard for your block is shown in the breakdown
above, so you can paste it straight into an ACL.
Building allowlists
Vendors publish their egress addresses as CIDR blocks; your firewall may want a range, or an
explicit list. Expanding the block here tells you exactly how many addresses you are about to
trust — which is the number worth looking at before approving a /16 because it
looked small in the ticket.
Questions
What range does 10.0.0.0/8 actually cover?
10.0.0.0 through 10.255.255.255 — 16,777,216 addresses. The /8 fixes the first eight bits, leaving 24 host bits, and 2²⁴ is that total.
Does the range include the network and broadcast addresses?
The address range does; the host range does not. Both are listed separately, because a firewall rule generally wants the full range while a DHCP pool wants the host range.
Can I paste a dotted mask instead of a prefix?
Yes — 192.168.1.0/255.255.255.0 works. Non-contiguous masks such as 255.0.255.0 are rejected with an explanation, because they are not valid CIDR.
What does /32 mean in a rule?
Exactly one address. It is the idiomatic way to write a single host in a firewall or route table, and the equivalent for IPv6 is /128.