IP range to CIDR converter

Firewalls and cloud security groups usually want CIDR blocks, not ranges. Enter the first and last address and SubnetMath returns the minimal set of blocks that covers exactly that range.

Binary

Split into subnets

    VLSM: hosts per subnet

    HostsSubnetRangeUsable

    IP range to CIDR

    –

    Subnet mask cheat sheet (/0 – /32)
    CIDRSubnet maskWildcardAddressesUsable hosts

    Saved you some time? Leave a tip, entirely optional.

    A range like 10.0.0.1 to 10.0.0.6 needs four blocks; a clean 192.168.1.0 to .255 needs one.

    How IPv4 subnetting works

    An IPv4 address is a 32-bit number, written as four 8-bit octets such as 192.168.1.10. A subnet divides those bits into two parts: the network bits, which are the same for every device on the subnet, and the host bits, which identify each device. The prefix length in CIDR notation, such as /24, says how many bits belong to the network. The subnet mask expresses the same thing in dotted-decimal form, with ones for network bits and zeros for host bits: /24 is 255.255.255.0. SubnetMath applies the mask to your address to find the network address (all host bits zero) and the broadcast address (all host bits one), and everything in between is the usable host range.

    Counting hosts

    A prefix of /n leaves 32 − n host bits, so the subnet contains 2^(32 − n) addresses. Two of them, the network and broadcast addresses, are normally reserved, so a /24 has 256 addresses and 254 usable hosts, a /26 has 64 and 62, and a /30 has 4 and 2. RFC 3021 allows /31 networks on point-to-point links with both addresses usable, and a /32 is a single host, often used for loopbacks and host routes.

    Splitting networks and VLSM

    Borrowing host bits creates smaller subnets: a /24 split into /26 networks gives four subnets of 64 addresses. With variable-length subnet masking you can give each subnet a different size, so a 100-host office gets a /25 while a 20-host lab gets a /27. Allocating the largest first keeps every block on its natural boundary and avoids overlaps. Cloud networks reserve a few extra addresses per subnet (AWS keeps five), so leave some headroom.

    Wildcard masks, ranges and special blocks

    A wildcard mask is the inverse of the subnet mask and is used in router access lists and OSPF. When a firewall needs CIDR blocks rather than a start and end address, the range converter finds the smallest set of aligned blocks that covers the range exactly. The calculator also flags private RFC 1918 addresses, loopback, link-local, carrier-grade NAT, multicast and documentation ranges so you can spot mistakes before they reach production. Everything runs in your browser and nothing you type is sent anywhere.

    Frequently asked questions

    Why so many blocks?

    CIDR blocks must start on a power-of-two boundary, so ragged ranges need several.

    Can I convert CIDR back to a range?

    Yes. Enter the block in the main calculator.

    Is the order important?

    Blocks are listed from lowest to highest address.

    Is SubnetMath free?

    Yes, with no sign-up or ads.

    Does it work offline?

    Yes, once the page has loaded.

    More tools