Firewalls, cloud security groups and allow lists usually want CIDR notation, not ranges. Type the first and last IP address and get the shortest list of CIDR blocks that covers exactly those addresses, nothing more.
Last updated:
IPv4 or IPv6. You can also paste "start - end" here
Enter your values to see the result.
Advertisement
Advertisement
How to use the IP Range to CIDR
Enter the start IP, for example 192.168.1.10 or 2001:db8::1.
Enter the end IP of the same version. You can also paste start - end into the first box.
Press Convert to CIDR. The result shows how many blocks are needed and lists each one.
Copy or download the CIDR list for your firewall, ACL or cloud rule.
How the CIDR list is built
A CIDR block a.b.c.d/n contains 232−n addresses and must begin on an address that is a multiple of that size. To cover an arbitrary range exactly, the converter repeatedly takes the largest aligned block that still fits:
Convert the start and end IP to integers.
Find the biggest power of two 2k that divides the start and where start + 2k − 1 ≤ end.
Output start/(32 − k) (or 128 − k for IPv6) and set start = start + 2k.
Repeat until start passes the end.
Example: 10.0.0.6 to 10.0.0.17. 10.0.0.6 is only divisible by 2, giving 10.0.0.6/31. Then 10.0.0.8 is divisible by 8, and 8 to 15 fits, so 10.0.0.8/29. Then 10.0.0.16 to 10.0.0.17 is 10.0.0.16/31. Three blocks, 12 addresses.
Ranges that map to a single block
Start IP
End IP
CIDR
Addresses
10.0.0.0
10.255.255.255
10.0.0.0/8
16,777,216
172.16.0.0
172.31.255.255
172.16.0.0/12
1,048,576
192.168.0.0
192.168.255.255
192.168.0.0/16
65,536
192.168.4.0
192.168.7.255
192.168.4.0/22
1,024
192.168.1.0
192.168.1.255
192.168.1.0/24
256
192.168.1.64
192.168.1.127
192.168.1.64/26
64
2001:db8::
2001:db8:0:ffff:ffff:ffff:ffff:ffff
2001:db8::/48
280
Tips
Most firewalls and cloud rules accept a list of CIDRs; some have a limit on entries, so check the block count before pasting.
If a rule limit is tight, the "smallest single covering block" is an option, but it allows addresses outside your range.
Ranges from geolocation or abuse databases are often published as start and end IPs: convert them before importing.
Frequently asked questions
How do you convert an IP range to CIDR?
Start at the first address and take the largest block of size 2^k that starts on a multiple of 2^k and does not pass the end address. Write it as start/(32 − k) for IPv4, move the start past it and repeat until the end is reached. This greedy method always gives the minimal list.
Why do I get several CIDR blocks instead of one?
A single CIDR block must start on a boundary that is a multiple of its size and contain a power-of-two number of addresses. A range like 192.168.1.10 to 192.168.1.100 is neither, so it has to be split into 7 blocks: /31, /30, /28, /27, /27, /30 and /32.
Can I cover the range with just one block?
Only if you accept extra addresses. The tool shows the smallest single block that contains the whole range, for example 192.168.1.0/25 for .10 to .100, and how many addresses outside your range it would include.
What is the maximum number of blocks a range can need?
For IPv4 at most 62 blocks (two per bit level, minus the ends); for IPv6 at most 254. In practice most ranges need far fewer.
Does it work with IPv6?
Yes. IPv6 addresses can be typed in compressed (2001:db8::1) or full form, and the calculations use exact 128-bit integers, so even enormous ranges are converted correctly.
What is the opposite conversion?
To turn a CIDR block such as 10.0.0.0/22 into its first and last IP, use a CIDR to IP range converter. Both directions describe the same set of addresses.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.