IP Range ⇔ CIDR Converter

Enter a start and end IP to split that range into the smallest possible set of CIDR blocks, or enter CIDR notation (e.g. 192.168.1.0/24) to get the block's first/last IP and total address count. Useful for firewall and ACL rule authoring.

To check a single IP with a subnet mask, see the subnet calculator , or for a reference table by prefix length, see the CIDR reference table .

Tips

  • Handy for turning a firewall or ACL range like "192.168.1.1 to 192.168.1.254" into CIDR notation your router configuration actually accepts.
  • Unless the range boundaries happen to align to a clean power of two, the IP range → CIDR conversion will produce several blocks. If you get too many blocks, reconsider where the range starts and ends to keep your ACL simpler.
  • For CIDR → IP range, even if the IP you enter isn't the exact start of a block, the tool rounds it to the network and broadcast address of the block it belongs to.
  • If you only need to check a single IP and mask, try the subnet calculator; for a full lookup table by prefix length, the CIDR reference table is a good companion to this tool.

Frequently Asked Questions

A CIDR block must always represent a power-of-two number of contiguous addresses (1, 2, 4, 8, ...) whose boundary is properly aligned. If the range you specify doesn't exactly match a single CIDR block, it takes a combination of several smaller, aligned blocks to represent the whole range without gaps or overlap.

A /24 has 8 host bits and covers 256 addresses from 192.168.1.0 to 192.168.1.255. By convention, the first address (192.168.1.0) is reserved as the network address and the last (192.168.1.255) as the broadcast address.

Most router and firewall ACL syntax only accepts CIDR notation (or a subnet mask plus wildcard mask) to describe a network range — it has no way to express an arbitrary start-to-end range directly. That's why you need to convert the range into CIDR blocks first, as this tool does, before applying it to your configuration.

An IP range is simply a way to describe a span of contiguous addresses from a start IP to an end IP. A CIDR block is a special case of an IP range whose boundaries align to a power-of-two position determined by the prefix length. Every CIDR block is an IP range, but not every IP range is a CIDR block.
ツールくん

Side Note — The algorithm behind IP range to CIDR conversion

The algorithm for splitting an IP range into CIDR blocks is a classic, approachable example of a "greedy algorithm" in computer science. The procedure is simple: at each position, pick the largest block that satisfies both how many bits of power-of-two alignment the current address has and how much of the remaining range is left, advance past that block, and repeat until you reach the end. This greedy approach is provably optimal — it always produces the theoretical minimum number of blocks.

In practice, engineers run into systems — cloud security groups, on-premises router ACLs, and more — that only accept CIDR notation rather than an arbitrary IP range. Converting an allocation handed down by a cloud provider, or a range that's been tracked internally as "10.1.0.10 to 10.1.0.50" in a spreadsheet, into router-ready CIDR blocks is an unavoidable step. Doing the bit arithmetic by hand is tedious and error-prone, which is exactly where a conversion tool like this one earns its keep.

The reverse direction — deriving an IP range from CIDR notation — comes up whenever you need a human-friendly "start to end" view of an allocated block. If a provider hands you "203.0.113.0/28", being able to instantly confirm the usable range is 203.0.113.0 through 203.0.113.15 lets you set up firewall allow-lists or DHCP scopes correctly the first time.

→ Read related trivia

→ Browse all trivia

More tools in this category