IP range to CIDR

Why one range becomes several blocks

A CIDR block has two constraints: its size must be a power of two, and it must start on an address that is a multiple of that size. An arbitrary range rarely satisfies both, so covering it exactly takes a sequence of blocks that grow as the alignment improves and shrink again at the end.

10.0.0.5 – 10.0.0.16

10.0.0.5/32   1 address   (5 is odd, so only a /32 fits)
10.0.0.6/31   2 addresses (6 is even)
10.0.0.8/29   8 addresses (8 is a multiple of 8)
10.0.0.16/32  1 address   (only one left)
= 12 addresses, exactly

The algorithm is greedy and provably minimal: at each step it takes the largest block that both starts at the current address and fits inside what remains.

Exact, never approximate

Every block produced is entirely inside the range you gave. Nothing outside it is ever included. That matters because the output usually becomes a firewall rule or a security-group entry, and a tool that rounded up to the nearest tidy block would silently grant access to addresses you did not intend.

If you would rather have fewer, larger blocks and can accept over-covering, widen the range you type in — that decision should be explicit, not made for you.

Where this conversion is required

• AWS security groups, NACLs and route tables — CIDR only, no ranges.
• Azure NSG rules and GCP firewall rules — same restriction.
• Kubernetes NetworkPolicy ipBlock fields.
• nginx allow/deny and Apache Require ip.
• BGP prefix lists and route filters.

Vendors, meanwhile, tend to document their addresses as “203.0.113.10 to 203.0.113.60” in an email. This page is the bridge between the two.

Sanity checks before you paste the output

1. Count the addresses. The total is shown; if it is far larger than you expected, one octet is probably wrong.
2. Watch for a huge first block. A /8 appearing in the list means the range spans far more than intended.
3. Check the boundaries. Ranges quoted in documentation are usually inclusive at both ends; some tools treat the last address as exclusive.
4. Prefer fewer rules where you can. Some platforms cap the number of rules per group, and a poorly aligned range can produce a dozen blocks.

Aligning the range makes life easier

If you control the allocation, choose ranges that start on a power-of-two boundary. A range from 10.0.0.0 to 10.0.0.255 is one clean /24; the same 256 addresses starting at 10.0.0.5 takes eight separate blocks. That is the single biggest thing you can do to keep firewall configuration readable.