IP Range Calculator

Runs in browser New Internet & Network

Paste a list of CIDR blocks, start–end ranges, short ranges such as 10.0.0.10-50, IPv4 wildcards or single addresses, IPv4 and IPv6 mixed. Each line is shown with its first and last address, its size and the CIDR blocks that cover exactly it; the list is checked for entries that share addresses, merged into the shortest exact CIDR list, and searched for one address if you give it. Everything is calculated in your browser.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How do you convert an IP range into CIDR blocks?

A CIDR block always starts on a multiple of its own size and holds a power of two addresses (RFC 4632), so an arbitrary start–end range usually needs several blocks: from the start, take the largest block that begins there and does not pass the end, and repeat. 10.0.0.128 to 10.0.1.63, for example, is 10.0.0.128/25 plus 10.0.1.0/26. The same rule merges a list: join the ranges that overlap or touch, then write each joined run as the fewest blocks, which gives the shortest exact list for a firewall or an allow-list.

Security note: Merging and summarizing can widen a rule: before replacing allow-list or firewall lines with fewer blocks, check that the result matches exactly the same addresses and not a larger block.

How to use IP Range Calculator

  1. Paste the ranges one per line into the list, for example from a firewall configuration or a cloud provider's published ranges; text after # is ignored.
  2. Read the table: each line as a range and as CIDR blocks.
  3. Check the overlaps and the warnings, then copy or download the merged CIDR list.
  4. To see which entries match a particular client, type its address in Address to look up.

IP Range Calculator features

  • Reads CIDR blocks (with a prefix length or a dotted netmask), start–end ranges written with -, –, "to" or "..", short ranges such as 10.0.1.10-99, IPv4 wildcards such as 192.168.1.* and single addresses, IPv4 and IPv6 in the same list
  • Every entry with its first and last address, its number of addresses and the exact CIDR blocks that cover it, in address order
  • Overlap check: each pair of entries sharing addresses, with the shared range and whether one contains the other, both are the same or they only partly overlap
  • A merged CIDR list that covers every listed address exactly once, ready to paste into a firewall, security group or allow-list, and downloadable as a text file
  • The smallest single block that holds all IPv4 or all IPv6 entries, with the number of extra addresses it would also cover
  • An address lookup that names every entry containing a given address, and line-by-line notes for entries it could not read or had to turn round

Inputs and outputs

Inputs

  • IP ranges, CIDR blocks or addresses: one per line, up to 2,000 lines, IPv4 and IPv6 mixed; # starts a comment.
  • Address to look up (optional): one IPv4 or IPv6 address to find in the list.

Outputs

  • At a glance: entries read, distinct IPv4 and IPv6 addresses, addresses listed more than once, and CIDR blocks after merging.
  • Each entry as a range and as CIDR blocks (CSV download), the merged CIDR list (text download) and the overlapping entries with their shared range.
  • Summary: the smallest single block per family and its extra addresses, the number of separate ranges after merging, and the entries that contain the looked-up address.

IP Range Calculator example

Cleaning up an allow-list with an overlapping range

Input:

10.0.0.0/24
10.0.0.128 - 10.0.1.63
10.0.1.64/26
10.0.2.10-50
2001:db8::/126
Address to look up: 10.0.1.20

Output:

Line 2 (10.0.0.128 - 10.0.1.63) = 10.0.0.128/25, 10.0.1.0/26 · Line 4 (10.0.2.10-50) = 41 addresses in 6 blocks
Overlap: 1. 10.0.0.0/24 with 2. 10.0.0.128 - 10.0.1.63, shared range 10.0.0.128 – 10.0.0.255, 128 addresses, partial overlap
Merged CIDR list (9 blocks): 10.0.0.0/24, 10.0.1.0/25, 10.0.2.10/31, 10.0.2.12/30, 10.0.2.16/28, 10.0.2.32/28, 10.0.2.48/31, 10.0.2.50/32, 2001:db8::/126
Smallest single block (IPv4): 10.0.0.0/22, which also covers 599 addresses outside your entries · Contained in: 2. 10.0.0.128 - 10.0.1.63

How to read the IP Range Calculator results

Addresses listed more than once counts every address that two or more entries cover, once each however many entries list it; zero means no two entries share an address.

"Contains the other" usually marks a redundant line: the smaller entry adds nothing. "Partial overlap" deserves a look, because the two lines were probably meant to touch, not to overlap.

Fewer blocks after merging than lines in your list means the list can be shortened without changing what it matches; more blocks means some entries are ranges that no single CIDR block can express.

A smallest single block with many extra addresses is a warning, not a suggestion: using it would match addresses none of your entries list.

When to use IP Range Calculator

  • Converting a provider's published start–end ranges into CIDR blocks for a firewall, a security group or a WAF that only accepts CIDR notation.
  • Auditing an allow-list or blocklist for duplicate and overlapping lines before it is deployed.
  • Answering "is this client address in our allow-list, and on which line?" during an incident or a support ticket.
  • Shortening a long list of addresses and small ranges into the fewest exact blocks for a router prefix-list or an ACL.

Troubleshooting

  • "not an IPv4 or IPv6 address, range or CIDR block": check for a stray character, a missing dot or a hostname; names are not resolved, only addresses are read.
  • "the two ends of the range are different address families": a range runs from IPv4 to IPv4 or IPv6 to IPv6; write two lines instead.
  • "a * may only stand for the last parts": 10.*.1.* is not a range; write it as separate lines or as CIDR blocks.
  • A line was "turned round": the range was written end first (10.0.0.9 - 10.0.0.1); the calculator swapped the ends and says so.

Frequently asked questions about IP Range Calculator

Why does one range become several CIDR blocks?

A CIDR block always starts on a multiple of its own size and holds a power of two addresses, so most ranges are not one block. 10.0.0.128 to 10.0.1.63 is 10.0.0.128/25 plus 10.0.1.0/26. The calculator takes the largest block that fits at each step, which gives the shortest possible list (RFC 4632 aggregation).

What does the merged CIDR list contain?

Every address that at least one entry covers, once: overlapping and touching entries are joined, then each joined run is written as the fewest CIDR blocks. Paste it into a firewall, a security group or an allow-list to replace the original lines without changing what they match.

How are overlaps reported?

Each pair of entries that share addresses is listed with the shared range, how many addresses it holds, and whether one entry contains the other, both are the same range, or they only partly overlap. Redundant firewall rules and conflicting allow-list lines usually show up here first.

Which formats can I paste?

One entry per line: 10.0.0.0/24 or 10.0.0.0/255.255.255.0, 10.0.1.10 - 10.0.1.99 (also with an en dash, "to" or ".."), the short form 10.0.1.10-99, an IPv4 wildcard such as 192.168.1.* and single IPv4 or IPv6 addresses. Text after # is treated as a comment. Lines that cannot be read are listed by number and the rest is still calculated.

What is the "smallest single block"?

The one CIDR block that holds every IPv4 (or IPv6) entry of the list. It is exact only when the entries fill it; otherwise the page says how many addresses outside your entries it would also cover, which is why a wide block is a risky shortcut in a firewall rule.

Technical notes

A CIDR block is a prefix: it starts on a multiple of its own size and holds 2^(bits − prefix) addresses (RFC 4632). Converting a range to blocks takes, from the start address, the largest block that starts there and does not pass the end, then repeats from the next address; this greedy rule gives the shortest exact list, never more than 2 × (bits − 1) blocks for any range.

Merging sorts the entries of each family by their first address and joins any entry that starts at or before the address after the current run's end, so overlapping and touching ranges become one run; each run is then converted to blocks. Overlaps are found with the same sorted order, comparing an entry only with the entries that start before it ends.

The smallest single block is the longest prefix shared by the lowest and highest merged address. All arithmetic is BigInt in @engines/ip-calc and @engines/ip, so IPv6 ranges are exact; an IPv4 address with a leading zero (010) is refused because some parsers read it as octal.

Limitations and methodology

Up to 2,000 lines per run, 200 overlap pairs listed and 5,000 blocks in the merged list; the counts above the tables still cover everything that was read.

Only addresses are read: host names, port numbers, protocols and firewall actions in a pasted rule are not understood and make the line unreadable.

It works on the list you give it: it cannot tell whether those addresses are in use, routed or assigned to anyone.

Security and privacy

The list and the address you look up are processed in your browser and are not sent anywhere; nothing is stored. Firewall rules and allow-lists can be pasted without leaving your device.

References