IP Range to CIDR

When you write firewall rules, routing tables, or access control lists, you often deal with arbitrary IP ranges like “192.168.1.10 through 192.168.1.200.” But most network devices and cloud security groups only accept CIDR notation (for example 192.168.1.0/24), not free-form ranges. This tool takes a start IP and an end IP and converts the range into the minimal set of CIDR blocks that cover it exactly.

It uses the standard IP range → CIDR algorithm, and all computation happens in your browser, so the IPs you enter are never sent anywhere. You can copy each CIDR block individually or the whole list at once, and you also get the total block count and total address count — ready to paste straight into a firewall, VPC, or routing configuration. To analyze a single CIDR in detail, use the CIDR calculator instead.

How an IP range becomes CIDR

An arbitrary IP range often cannot be expressed as a single CIDR, because a CIDR block must always be a power-of-two size and must be aligned to that size. So the range has to be split into several aligned blocks. Starting from the first address, the algorithm repeats these steps:

1. Find the largest block size the current start address can hold without breaking alignment (determined by its lowest set bit).
2. Find the largest block size that does not exceed the number of remaining addresses.
3. Pick the smaller of the two as the block, then advance the start address by that amount.

This covers the range exactly while keeping the number of blocks at a minimum. For example,192.168.1.0–192.168.1.130 splits into 192.168.1.0/25 (0–127),192.168.1.128/31 (128–129), and 192.168.1.130/32 (130).

Where you use it

• Firewalls / security groups: AWS Security Groups and GCP/Azure firewall rules accept CIDR only.
• Routing / static routes: Router and load balancer route entries need CIDR form.
• ACLs / WAF allowlists: Compressing an IP range into CIDR reduces the number of rules.

Before converting, the Private IP Checker helps you confirm whether the target range is private or reserved.

Things to note

This tool supports IPv4 only. The end IP must be greater than or equal to the start IP; if both are equal it becomes a single /32 host. Conversely, the full range 0.0.0.0–255.255.255.255 is expressed as a single 0.0.0.0/0.

Prefix length and block size cheat sheet

To sanity-check the split, it helps to know how many addresses each prefix (/n) covers. A block size is always 2^(32 − n), and the start address must be a multiple of that size (i.e. aligned).

Worked example: 10.0.0.5 – 10.0.0.20

This shows how an unaligned start address forces small blocks first. The start 10.0.0.5 is odd, so it can only hold a /32 (not even, so no /31). Step by step:

Sixteen addresses (5–20) split into five CIDRs. Had the range been the cleanly aligned10.0.0.0 – 10.0.0.15, it would have collapsed to a single 10.0.0.0/28. In other words, for the same address count, the block count depends heavily on alignment.

Common pitfall

• Guessing the prefix from the count: it is tempting to think “16 addresses, so one /28,” but unless the start is a multiple of 16 it can never be a single /28. Alignment matters before count.
• Entering the end IP as exclusive: the end IP here is inclusive. To cover up through 10.0.0.20, enter 10.0.0.20. Entering 10.0.0.21 includes one extra address and changes the blocks.
• Worrying about network/broadcast addresses: a CIDR block covers the entire address range including the network and broadcast addresses, so no address inside your range is ever left out.