About the CIDR to IP Range
This CIDR to IP range tool works in both directions. In CIDR mode, enter a block such as 10.0.0.0/22 — or several, one per line — to get the first and last address, the total number of addresses, the usable host range, the netmask and the wildcard mask. In range mode, enter a start and end address such as 192.168.1.10 to 192.168.1.100 and get the minimum set of CIDR blocks that covers exactly that range, with nothing extra.
It is built for anyone writing firewall rules, AWS security groups, VPC and subnet plans, nginx or Apache allow/deny lists, geo-IP blocks or ACLs, where some systems want CIDR notation and others want explicit ranges. Range-to-CIDR is the step that trips people up: an arbitrary range usually needs several blocks of different sizes.
If a CIDR is written with host bits set (for example 10.1.2.3/16), it is normalised to the true network address 10.1.0.0/16, which is how routers and cloud consoles interpret it. Usable hosts exclude the network and broadcast addresses, except for /31 point-to-point links (RFC 3021) and single-host /32s.
How to use the cidr to ip range
- 1Choose CIDR → IP range or IP range → CIDR list.
- 2For CIDR mode, paste one or more blocks such as 10.0.0.0/22, one per line.
- 3For range mode, enter the start and end IPv4 addresses.
- 4Copy the range, or the CIDR list, into your firewall, security group or config file.
Formula and method
An IPv4 address is a 32-bit number. A CIDR prefix of /n fixes the first n bits as the network, leaving 32 − n host bits, so the block contains 2^(32 − n) addresses. The first address is found by clearing the host bits (equivalently, rounding the address down to a multiple of the block size) and the last by setting them all to 1. The netmask has n leading ones; the wildcard mask is its inverse.
Converting a range to CIDRs uses the standard greedy algorithm: starting at the first address, take the largest block that both starts on a boundary aligned to its own size and ends no later than the last address, then continue from the address after it. This always produces the minimum number of blocks — at most 62 for any IPv4 range.
- prefix
- Number of network bits after the slash (0–32)
- size
- Number of addresses in the block
- IP
- The address as a 32-bit unsigned integer
Worked examples
10.0.0.0/22 to a range
A /22 leaves 10 host bits, so it holds 2¹⁰ = 1,024 addresses from 10.0.0.0 to 10.0.3.255. Removing the network and broadcast addresses leaves 1,022 usable hosts.
Arbitrary range to the minimum CIDR list
192.168.1.10–100 is 91 addresses. Starting at .10, the largest aligned block is a /31 (.10–.11), then /30 (.12–.15), /28 (.16–.31), two /27s (.32–.95), a /30 (.96–.99) and a single /32 for .100 — seven blocks with no gaps or extras.
Host bits set are normalised
A /20 block is 4,096 addresses, so it must start on a multiple of 16 in the third octet. 45 rounds down to 32, giving 172.16.32.0/20, which runs to 172.16.47.255.
Frequently asked questions
How many IP addresses are in a CIDR block?+
A /n block has 2^(32 − n) addresses: /32 is 1, /30 is 4, /24 is 256, /22 is 1,024, /16 is 65,536 and /8 is 16,777,216. Subtract 2 for usable hosts on a normal subnet, because the network and broadcast addresses cannot be assigned.
Why does my IP range need several CIDR blocks?+
A CIDR block must contain a power-of-two number of addresses and start on an address divisible by that size. A range like .10 to .100 is neither, so it has to be built from several smaller aligned blocks.
What does 0.0.0.0/0 mean?+
0.0.0.0/0 has no network bits fixed, so it matches every IPv4 address — all 4,294,967,296 of them. In routing it is the default route; in a firewall or security group it means “anywhere”.
What is a wildcard mask?+
A wildcard mask is the bitwise inverse of the subnet mask, so 255.255.255.0 becomes 0.0.0.255. Cisco ACLs and OSPF network statements use it: 0 bits must match exactly and 1 bits can be anything.
Does AWS reserve addresses in a subnet?+
Yes. AWS reserves the first four and the last address in every VPC subnet, so a /24 subnet gives 251 usable addresses instead of 254. Other clouds have similar rules, so check your provider’s documentation.