Quick answer
Enter a first and last IP (for example 192.168.1.10 – 192.168.1.20) to get the smallest set of CIDR blocks covering exactly that range (192.168.1.10/31, 192.168.1.12/30, 192.168.1.16/30, 192.168.1.20/32). “Merge a list” removes duplicates and joins adjacent blocks; “Check an IP” tells you which lines of a list contain an address. Works for IPv4 and IPv6.
What is CIDR?
Firewalls, nginx, Cloudflare, AWS security groups and .htaccess only accept CIDR notation, while ISPs, partners and spreadsheets tend to give you “from this IP to that IP”. This tool turns any range into the minimal CIDR list (RFC 4632), shrinks long allow / block lists to as few lines as possible, and quickly checks whether an IP is on a list. Everything runs in your browser, including large IPv6 blocks.
How to use it
- 1
Pick a task: “Range → CIDR”, “Merge a list” or “Check an IP”.
- 2
Range → CIDR: enter the first and last IP (both IPv4 or both IPv6; reversed order is fine) to get the CIDR blocks.
- 3
Merge a list: paste one CIDR, IP or “a - b” range per line; lines starting with # are comments. Duplicates are removed, adjacent blocks joined and unreadable lines reported.
- 4
Check an IP: enter an IP and paste a list to see which lines contain it (handy for finding which firewall rule matches).
- 5
Use “Copy CIDR list” to paste the result into your config.
IPv4 block size by prefix
| Prefix | Addresses | Netmask |
|---|---|---|
| /32 | 1 | 255.255.255.255 |
| /30 | 4 | 255.255.255.252 |
| /29 | 8 | 255.255.255.248 |
| /28 | 16 | 255.255.255.240 |
| /27 | 32 | 255.255.255.224 |
| /26 | 64 | 255.255.255.192 |
| /24 | 256 | 255.255.255.0 |
| /22 | 1,024 | 255.255.252.0 |
| /16 | 65,536 | 255.255.0.0 |
| /8 | 16,777,216 | 255.0.0.0 |
A CIDR block is always a power of two in size and must start on an address divisible by that size, which is why an arbitrary range usually needs several blocks.
List syntax in common systems
| System | One entry | Notes |
|---|---|---|
| nginx | allow 203.0.113.0/24; | Finish with deny all; for an allowlist |
| Apache 2.4 (.htaccess) | Require ip 203.0.113.0/24 | Several blocks separated by spaces |
| iptables | -s 203.0.113.0/24 | Use ipset for long lists |
| Cloudflare, AWS, GCP | 203.0.113.0/24 | One block per entry, entry limits apply |
Worked examples
A partner sends an odd range
A payment provider asks you to allow 203.0.113.10 – 203.0.113.40. You get 5 blocks: .10/31, .12/30, .16/28, .32/29, .40/32; add them to the firewall without opening a single extra IP.
Shortening an allowlist
10.0.0.0/25, 10.0.0.128/25 and 10.0.1.0/24 merge into a single line, 10.0.0.0/23.
Finding the rule that blocks a visitor
A customer can't reach the site from 198.51.100.77. Paste the blocklist and the IP into “Check an IP” to see that 198.51.100.0/24 matches.
Merging IPv6
2001:db8::/33 and 2001:db8:8000::/33 merge into 2001:db8::/32; IPv4 and IPv6 results are listed separately.
Common problems
- Writing 192.168.1.10/28 to cover 192.168.1.10 – 192.168.1.20.
- A /28 can only start at .0, .16, .32…; 192.168.1.10/28 is really 192.168.1.0 – .15. Use Range → CIDR for the correct list.
- Using one big block for convenience and opening extra IPs.
- Instead of a /24 for the whole 0–255, allow only the blocks returned, especially for admin access allowlists.
- “First and last IP must both be IPv4 or both IPv6.”
- A range is either IPv4 or IPv6; to allow both, enter two separate ranges.
- Some lines are skipped when merging.
- The tool lists unreadable lines; usually a missing number, a prefix above 32 (IPv4) / 128 (IPv6) or a typo.
How the minimal CIDR list is found
Starting at the first IP, the tool picks the largest block that both starts exactly at that address (aligned to a power of two) and doesn't pass the last IP, then repeats from the address just after it. This greedy approach yields the fewest possible blocks and always covers the range exactly, without a single extra or missing address.
When merging, entries are sorted, overlapping or adjacent ranges are joined, and each joined range is converted to CIDR the same way.
Glossary
- CIDR
- Classless Inter-Domain Routing (RFC 4632): writing an address block as “address/prefix”, e.g. 10.0.0.0/8.
- Prefix
- The number of fixed leading bits; the smaller the prefix, the larger the block.
- Aggregation
- Joining adjacent blocks into a larger one to shorten a list.
- Allowlist
- A list of IPs permitted to connect; everything else is blocked.
Frequently asked questions
Why does one range become several CIDR blocks?
CIDR blocks must be a power of two in size and start on an address divisible by that size. Ranges that start or end on “odd” addresses (e.g. .10 – .20) must be built from several smaller blocks.
Does the result include any extra IPs?
No. The blocks add up to exactly the number of addresses in the range, shown in the summary above the table.
Does it work with IPv6?
Yes, in all three modes. Big-integer maths keeps every IPv6 block exact.
What input format does the list accept?
One CIDR, single IP or “first - last” range per line (or comma-separated). Lines starting with # are ignored.
Is my list sent anywhere?
No. All processing happens in your browser.
How do I see details of a block (netmask, broadcast)?
Use the IPv4 or IPv6 Subnet Calculator with a block returned here.
Ratings and comments
Loading…