Why is the result larger than my range?

CIDR blocks must start on a boundary and have a power-of-two size. If your start and end are not aligned, the covering block necessarily includes extra addresses on both sides — the tool picks the smallest such block.

Why did my range split into several CIDRs?

Some ranges cannot be covered by a single block without huge waste. The tool then returns the minimal set of contiguous blocks that exactly covers your endpoints, which is still valid for firewall rules.

What does /32 mean here?

/32 is a block of exactly one address — start and end are the same. It is the tightest possible rule and often what you want when whitelisting a single host.

IPv4 range expander — Guide

Given a start and an end IPv4 address, this tool calculates a valid IPv4 subnet along with its CIDR notation.

What it is and when to use it

Given a start and an end address, this tool finds the smallest CIDR block (or a minimal set of blocks) that covers the whole range. Useful when a firewall, cloud security group or routing table only accepts CIDR notation but your list of machines was defined by two endpoints.

Given a start and end IP, computes the minimal list of CIDR blocks covering that range — very practical when tidying firewall rules.

How to use it

Enter the start IP
Enter the end IP
Read the generated CIDR list

A worked example

Fill in a sample start IP

10.0.0.1

Copy this into the tool, or open IPv4 range expander

Things that trip people up

If the range is not a contiguous block it is split into several CIDRs — that is expected

Questions people ask

Why is the result larger than my range?: CIDR blocks must start on a boundary and have a power-of-two size. If your start and end are not aligned, the covering block necessarily includes extra addresses on both sides — the tool picks the smallest such block.
Why did my range split into several CIDRs?: Some ranges cannot be covered by a single block without huge waste. The tool then returns the minimal set of contiguous blocks that exactly covers your endpoints, which is still valid for firewall rules.
What does /32 mean here?: /32 is a block of exactly one address — start and end are the same. It is the tightest possible rule and often what you want when whitelisting a single host.

Next steps

Open the IPv4 range expander tool

Spotted something wrong on this page? Tell us via Contact Us