Enter a network like 192.168.0.0/22 to see the range it covers, or two addresses to get the shortest list of CIDR blocks that covers exactly that range — ready to paste into a firewall rule.
Runs entirely in your browser — nothing you enter here is sent to a server.
A CIDR block is an address followed by a slash and a number: 192.168.0.0/22. The number is the prefix length — how many of the 32 bits are fixed. The remaining bits are free, so a /22 leaves 10 bits and covers 2¹⁰ = 1,024 addresses, from 192.168.0.0 to 192.168.3.255. Each step down in the prefix doubles the block: a /24 is 256 addresses, a /23 is 512, a /16 is 65,536.
Fix the first n bits. All free bits zero gives the first address, all ones gives the last.
A block must start on a multiple of its own size, so an arbitrary range usually needs several blocks.
This tool takes the largest aligned block that fits at each step, which always gives the fewest blocks.
Nothing outside the range is included and nothing inside is missed — safe for allow and deny rules.
Take 192.168.0.1 to 192.168.0.10. No single block fits: a /28 starting at 192.168.0.0 would also include .0 and .11–.15. The exact answer is five blocks — .1/32, .2/31, .4/30, .8/31 and .10/32. Firewalls, cloud security groups, routing tables and CDN allowlists accept CIDR blocks rather than ranges, which is why this conversion comes up whenever a vendor publishes its addresses as "from … to …".
If your list is long, check whether widening the range slightly is acceptable: 192.168.0.0 to 192.168.0.15 is a single /28. Whether those few extra addresses matter depends on who owns them.
256, of which 254 can be given to hosts — the first is the network address and the last is the broadcast address. A /25 has 128, a /23 has 512.
They say the same thing. /24 means the first 24 bits are the network part; written as a mask that is 255.255.255.0.
A CIDR block must begin at an address divisible by its size and contain a power-of-two number of addresses. A range that starts or ends anywhere else has to be assembled from several smaller blocks.
Yes. If the first address is higher than the second they are swapped.
Upzilla checks your services from outside your network, so you find out at once when a rule shuts out real traffic. 10 monitors free.