Enter a subnet mask such as 255.255.240.0 or a prefix like /20 and get the wildcard (inverse) mask used in access lists and OSPF or EIGRP network statements. Add a network address to see exactly which IPs it matches.
Last updated:
Start from
Dotted mask (255.255.240.0) or prefix (/20 or 20)
Non-contiguous wildcards such as 0.0.254.255 are allowed
Used for the matching range and the commands
Command options
1 to 99; the extended example uses a number from 100 to 199
Enter your values to see the result.
Advertisement
Advertisement
How to use the Wildcard Mask Calculator
Choose what you have: a subnet mask/CIDR prefix, or a wildcard mask.
Type the mask, for example 255.255.255.224, /27 or 0.0.0.31.
Add a network address (optional) to see the first and last IP the wildcard matches.
Press Calculate wildcard mask and read the wildcard, prefix and address count.
Copy the commands for your ACL, OSPF or EIGRP configuration, adjusting the ACL number and area if needed.
Wildcard mask formula
A wildcard mask is the bitwise inverse of a subnet mask: wildcard = 255.255.255.255 − subnet mask, octet by octet. Where the subnet mask has a 1 bit (network part), the wildcard has a 0 bit ("must match"), and where the mask has a 0 bit (host part), the wildcard has a 1 bit ("don't care").
Example: a /21 network uses the mask 255.255.248.0. Subtracting each octet from 255 gives 0.0.7.255. With the network 10.20.8.0, the wildcard matches 211 = 2,048 addresses, from 10.20.8.0 to 10.20.15.255, and the OSPF line is network 10.20.8.0 0.0.7.255 area 0.
Common wildcard masks
Prefix
Subnet mask
Wildcard mask
Addresses matched
/8
255.0.0.0
0.255.255.255
16,777,216
/16
255.255.0.0
0.0.255.255
65,536
/20
255.255.240.0
0.0.15.255
4,096
/22
255.255.252.0
0.0.3.255
1,024
/23
255.255.254.0
0.0.1.255
512
/24
255.255.255.0
0.0.0.255
256
/25
255.255.255.128
0.0.0.127
128
/26
255.255.255.192
0.0.0.63
64
/27
255.255.255.224
0.0.0.31
32
/28
255.255.255.240
0.0.0.15
16
/29
255.255.255.248
0.0.0.7
8
/30
255.255.255.252
0.0.0.3
4
/32
255.255.255.255
0.0.0.0
1 (host)
Tips for ACLs and OSPF
Standard ACLs (1-99) match only the source address; extended ACLs (100-199) can match source, destination, protocol and ports, each with its own wildcard.
Every ACL ends with an invisible deny any, so add the permit lines you need before applying it to an interface.
In OSPF, the wildcard in a network statement selects which interfaces join the area; 0.0.0.0 after an interface IP enables exactly that one interface.
Mixing 0 and 1 bits (non-contiguous wildcards) is allowed in ACLs but makes rules hard to read: document them well.
Frequently asked questions
How do you calculate a wildcard mask?
Subtract each octet of the subnet mask from 255. For 255.255.255.192 that gives 0.0.0.63. In binary, every bit is flipped: the network bits (1s in the mask) become 0s, and the host bits become 1s.
What is the wildcard mask for /24?
A /24 has the subnet mask 255.255.255.0, so its wildcard mask is 0.0.0.255. It matches all 256 addresses whose first three octets equal the network address, for example 192.168.10.0 to 192.168.10.255.
What do 0 and 1 mean in a wildcard mask?
A 0 bit means the corresponding bit of the address must match the value in the statement. A 1 bit means that bit can be anything. So 0.0.0.0 matches one exact host and 255.255.255.255 matches every address.
Is a wildcard mask the same as an inverse mask?
For contiguous masks, yes: the inverse mask is the bitwise NOT of the subnet mask, and that is what OSPF and EIGRP network statements use. ACLs go further and allow non-contiguous wildcards, where 0 and 1 bits can be mixed.
What is a non-contiguous wildcard mask used for?
It lets one ACL line match a pattern instead of a single block, for example 10.1.0.0 0.0.254.255 matches every subnet 10.1.x.0/24 whose third octet is even. Such wildcards have no matching subnet mask and are not accepted by routing protocol network statements.
Why does the router change my ACL address?
If the address has bits set where the wildcard has 1s, those bits are ignored, so IOS stores the normalised address. 192.168.10.77 0.0.0.255 is saved as 192.168.10.0 0.0.0.255. This calculator shows the normalised value too.
How do I write a wildcard for a single host or any host?
Use 0.0.0.0 for a single host, which IOS lets you write as host 10.1.1.5. Use 255.255.255.255 with 0.0.0.0 to match everything, written as the keyword any.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.