IP Range to CIDR

Address ranges are how people describe things: “the supplier uses 203.0.113.10 to 203.0.113.200”. Firewalls, cloud security groups and route filters mostly want CIDR blocks instead. The page converts a range into the smallest set of blocks that covers it exactly, so nothing outside the range is allowed in by accident.

Why one range may need several blocks

A CIDR block is a start address and a prefix length. Two conditions apply: the number of addresses is a power of two, and the start is a multiple of that size. A /24 covers 256 addresses and must begin on a multiple of 256. A range such as 10.0.0.1 to 10.0.0.6 cannot be one block because it starts at an odd number and has six addresses. The only way to cover it exactly is with smaller aligned pieces.

The algorithm

The page starts at the first address. It picks the largest block whose size divides the start address and that does not run past the end of the range, adds it to the list, moves the start to just after that block and repeats. This greedy approach is provably minimal for ranges, because at each step any smaller block could only be replaced by a larger one that is aligned. It works the same way for IPv6 with 128-bit addresses. The output lists one block per line in order, and the summary shows the total addresses and the block count.

Using it

Enter ranges as start - end, one per line. You can paste several at once and each gets its own result group; a range that mixes IPv4 and IPv6, or lacks an end, gets an error message instead. Copy or download the list of blocks to use in a rule set. The sample includes an exact /22, a range that needs four blocks, a messy range that needs eight, and an IPv6 range, so you can see how alignment affects the count.

A worked example

Take 203.0.113.10 - 203.0.113.200, which is 191 addresses. Starting at .10, the largest aligned block is a /31 (.10 to .11) because 10 is not a multiple of 4. Next is .12 as a /30 (to .15), then .16 as a /28 (to .31), then .32 as a /27 (to .63), then .64 as a /26 (to .127). At .128 a /26 fits again (to .191), but a /25 would run past .200. Next is .192 as a /29 (to .199) and finally .200 as a /32. That is eight blocks, matching the page. By contrast 192.168.0.0 - 192.168.3.255 is exactly one /22 with 1,024 addresses, and 2001:db8:: - 2001:db8::ffff is a single IPv6 /112.

Limits

The result is exact, so it can be long for awkward ranges, and some platforms limit the number of rules. In that case you must decide whether to widen the range, which this page does not do on its own. If you want to see how widening would work, the Route Summarization Calculator shows the cost of a looser covering block. The page does not check overlaps between lines or whether the addresses are public.

Related tools

• CIDR to IP Range goes the other way, from blocks to first and last address.
• Route Summarization Calculator merges many networks into the shortest covering prefix.
• Subnet Calculator explains any one block in detail.
• IPv4 to Integer Converter converts the endpoints to numbers for range queries.