FIRST CH TOOLS LOCAL PROCESSING — NOTHING LEAVES YOUR DEVICE 日本語

FIRST CH TOOLS / Development / 49 CIDR CALCULATOR

IP / CIDR Calculator

Type a block such as 192.168.1.0/24 and read off the network address, broadcast address and the range and count of usable hosts straight away. Split a network into subnets, check an address before you add it to an allow list, and reduce an arbitrary IP range to the smallest set of CIDR blocks — all on one page, for both IPv4 and IPv6.

1 — CIDR or subnet mask

2 — Results

3 — Is this address inside the block?

4 — Split into subnets

Divides one network into equally sized subnets — the allocation table you need when handing out address space per VLAN or per team (the first 128 rows are listed).

5 — IP range → smallest CIDR set

0 blocks / 0 addresses 

    
    
  
    

  
    Nothing you type leaves the browser — every calculation runs on this page. Settings can be passed in the URL: /en/cidr/?cidr=10.0.0.0/16&split=20 / /en/cidr/?cidr=192.168.1.0/24&ips=192.168.1.77,10.0.0.1 / /en/cidr/?range=10.0.0.5-10.0.0.200;10.0.1.0/24 (use ; between lines).
    

  
    
    
    How to Use
    
    
      
      
    1. Paste the blockCopy the 10.0.0.0/16 style notation from your router or cloud console. A plain subnet mask such as 255.255.255.0, or the wildcard mask used in ACLs, is understood as well.
      2. 
      
    2. Read the rangeYou get the network address, the broadcast address and the usable host range. “+1 bit” and “−1 bit” let you compare what happens when the block is halved or doubled.
      3. 
      
    3. Copy it into the configTake the subnet allocation table or the block for your allow list. When all you have is a start and an end address, use the last panel to turn it into the fewest CIDR blocks first.
      4. 
    
    
  
    

  
    
    
    About This Tool
    
    
    The 24 in /24 means the leftmost 24 bits identify the network. An IPv4 address is a 32-bit number: the front part names the network, the rest numbers the hosts inside it. Move the boundary by a single bit and the number of hosts doubles or halves — /24 holds 256 addresses (254 usable), /25 holds 128 (126). That boundary is exactly what a subnet mask expresses, which is why 255.255.255.0 and /24 are two ways of saying the same thing.
    
    
    The first and last addresses are normally not usable. The first one names the network itself and the last one is reserved for broadcasts to everyone on it, which is why a /24 gives you 254 hosts rather than 256. There are two exceptions: on a /31 both addresses may be assigned, because it exists for point-to-point links between routers (RFC 3021), and a /32 names a single host — the form you normally use in an allow list. IPv6 has no broadcast address at all.
    
    
    Going from a range back to CIDR is the part that is hard to do in your head. Someone asks you to allow 192.168.1.5 through 192.168.1.200, but the firewall or security group only accepts CIDR. That range does not line up with a single block, so it has to be covered by a mix of /32 through /26 blocks. Round up and you let strangers in; round down and you lock out the people you meant to admit. This tool merges overlapping ranges first and then emits the minimum number of blocks that cover them exactly.
    
    
    Blocks reserved for a special purpose — the private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback, or the documentation range 203.0.113.0/24 — are labelled as such in the results. For neighbouring server chores see the Unix Time Converter, the Cron Explainer and the Hash Generator.
    
  
    

  
    
    
    IPv4 prefix cheat sheet
    
    
    
      
    
      
    
        
    CIDRSubnet maskAddressesHostsTypical use
    
        
          
    /8255.0.0.016,777,21616,777,214All of 10.0.0.0/8
    
          
    /16255.255.0.065,53665,534A VPC or a site
    
          
    /20255.255.240.04,0964,094Cloud subnet
    
          
    /24255.255.255.0256254One floor or segment
    
          
    /26255.255.255.1926462Small team or VLAN
    
          
    /28255.255.255.2401614A handful of servers
    
          
    /29255.255.255.24886Static IPs from an ISP
    
          
    /30255.255.255.25242Router-to-router link
    
          
    /31255.255.255.25422Point-to-point (RFC 3021)
    
          
    /32255.255.255.25511A single host in an allow list
    
            
      
    
      
    
    
    
  
    

  
    
    
    Where subnet maths goes wrong
    
    
    
      
    
        
    Leaving host bits set in a config file
    
        
    192.168.1.130/24   ← as a /24 network this means 192.168.1.0/24
    
        
    Written into an allow list or a route, some implementations silently treat it as 192.168.1.0/24, so a rule meant for one machine opens up 254 of them; others reject it as a syntax error, and you cannot rely on which you will get. Use /32 for a single host and the network address for a whole block. This tool tells you when the address you typed is not the network address, and shows the block it belongs to.
    
      
    
      
    
        
    Misremembering the private ranges
    
        
    172.16.0.0 – 172.31.255.255   ← 172.16.0.0/12 (172.16 through 172.31)
172.16.0.0/16                 ← assuming it stops here is how collisions happen
    
        
    The 10 and 192.168 ranges are easy, but the 172 range is a /12: the second octet runs from 16 to 31. Address collisions in site-to-site VPNs and VPC peering usually trace back to misreading those sixteen blocks. When designing a new network, pick a corner that will not clash with whoever you may connect to later.
    
      
    
      
    
        
    Subnets only start on aligned boundaries
    
        
    192.168.1.0/26    0 – 63     ← always aligned to multiples of 64
192.168.1.64/26   64 – 127
192.168.1.100/26  ← cannot start here
    
        
    A block must begin at a multiple of its own size, so a /26 (64 addresses) starts at 0, 64, 128 or 192. “Sixty addresses starting at 100” is not expressible as one block and breaks into several. Design by rounding the host count up to a power of two first, then choosing where it sits.
    
      
    
      
    
        
    A bigger number means a smaller block
    
        
    /16 > /24 > /28    ← the larger the number, the narrower the block
    
        
    The prefix length counts the bits you pin down, so a larger number leaves fewer bits for hosts. Routers prefer the longest (narrowest) match, which means a specific route added next to a broad one wins for the addresses it covers. That is how a rule you believed applied to everything ends up overridden for part of the range.
    
      
    
      
    
        
    Treating IPv6 as “IPv4 with more digits”
    
        
    2001:db8:abcd::/48  → 65,536 subnets of /64
never split below /64 (SLAAC stops working)
    
        
    In IPv6 the mechanism that lets hosts build their own address (SLAAC) assumes a /64, so LAN segments are always /64. There is no need to economise: when your ISP hands you a /48 or a /56, carve it into /64s. There is no broadcast address either — multicast (ff00::/8) takes that role.
    
      
    
      
    
        
    Putting a private address in an allow list
    
        
    192.168.1.0/24   ← correct inside your office, meaningless to an outside service
    
        
    What a SaaS or API allow list needs is the global address the internet sees you as. Registering the private address your laptop happens to have achieves nothing, because NAT rewrites it on the way out. This tool labels the type of every block you enter, so check that you are not about to send something marked “private” to an external vendor.
    
      
    
    
    
  
    

  
    
    
    Other Tools