CIDR & IP Range Converter

What is a CIDR range converter?

A CIDR range converter moves between two ways of describing a block of IP addresses: CIDR notation (network and prefix, such as 172.16.20.0/22) and an explicit start/end address range. It also solves the harder reverse problem exactly: given an arbitrary range that doesn't align to one prefix, it finds the smallest set of correctly aligned CIDR blocks that covers it precisely, with no addresses added.

CIDR to IP range

Every CIDR block corresponds to exactly one contiguous address range. 172.16.20.0/22 spans 172.16.20.0 through 172.16.23.255 — 1,024 addresses, the entire block, not just the traditionally usable host portion.

IP range to CIDR

Going the other direction is only simple when the range happens to align to a power-of-two boundary. 10.0.0.0 through 10.0.3.255 is exactly one CIDR, 10.0.0.0/22. Most arbitrary ranges aren't this convenient, which is why exact decomposition into multiple blocks matters.

Why one IP range may need several CIDRs

A single CIDR block always starts on an address that's a multiple of its own size. A range like 10.0.0.5 through 10.0.0.100 starts and ends at addresses that don't sit on any shared boundary, so no single prefix can represent it exactly. The converter finds the minimum number of aligned blocks that together cover precisely that range — never fewer addresses, never more.

Exact CIDR coverage

This tool's default behavior is exact: the CIDR blocks it returns cover exactly the range you asked for, with zero addresses outside it. That matters for firewall rules, ACLs and cloud network policies, where granting access to a few extra addresses beyond an approved range is a real security concern. A broader, routing-oriented supernet (which can include extra addresses for the sake of a shorter route table) is a different tool with a different goal.

How CIDR alignment works

The decomposition works by repeatedly taking the largest block that both (a) starts exactly where the remaining range begins and (b) doesn't extend past its end. Because every valid block size is a power of two, this greedy approach always produces the minimum possible number of blocks for the requested range.

CIDR range vs. usable host range

The "range" a CIDR describes is its entire address block, including the network and broadcast addresses. The traditionally usable host range excludes those two. 172.16.20.0/22's range is all 1,024 addresses; its usable host range is the 1,022 addresses in between. This tool always shows both, clearly labeled, since conflating them is a common source of firewall and DHCP scoping mistakes.

/31 and /32 ranges

A /31 remains a valid network prefix. Under RFC 3021 point-to-point semantics, neither of its two addresses is reserved as a traditional network or broadcast address, so both appear as usable range endpoints. A /32 is a single address: its range start and end are the same address, with no network, broadcast or host-range concept.

IPv4 vs. IPv6 ranges

The same exact-decomposition logic applies to IPv6, using 128-bit arithmetic (never floating-point) so precision is never lost even for enormous ranges. IPv6 has no broadcast address and doesn't use the IPv4 usable-host-minus-two convention; a range or CIDR's total address count is its full size.

Merging CIDR blocks

The Merge mode takes a pasted list of CIDRs, removes exact duplicates and any prefix fully contained within a larger one you supplied, then repeatedly combines adjacent, correctly aligned sibling pairs into a single larger block. The result covers exactly the same addresses as the cleaned-up input — merging never introduces addresses that weren't already represented.

CIDR conversion for firewalls and cloud networks

Firewalls, ACLs, VPN configurations and cloud network policies (security groups, NSGs, VPC firewall rules) typically accept CIDR blocks, not arbitrary IP ranges. Converting an approved range into its exact minimal CIDR set lets you configure access precisely, without granting more than intended. Different platforms have different limits on how many rules or prefixes a policy can contain; this tool doesn't assume any particular platform's limits or provide vendor-specific configuration steps.

CIDR Range Converter vs. Subnet Calculator

The Subnet Calculator analyzes one CIDR block in detail: its mask, classification, and binary layout. This tool is about conversion between representations, and about the range-to-CIDR problem specifically. Once you have a resulting CIDR here, open it in the Subnet Calculator for that deeper single-subnet detail.

Worked examples

Example 1: CIDR → range

172.16.20.0/22 converts to the range 172.16.20.0 through 172.16.23.255 — 1,024 addresses.

Example 2: exact single CIDR

10.0.0.0 through 10.0.3.255 aligns exactly to one block: 10.0.0.0/22.

Example 3: non-aligned range requiring multiple CIDRs

10.0.0.5 through 10.0.0.100 (96 addresses) requires 8 blocks for exact coverage:

The 8 blocks total exactly 96 addresses — the same 96 addresses in the requested range, no more.

Example 4: merging sibling CIDRs

10.0.0.0/25 and 10.0.0.128/25 are exact, aligned siblings, so they merge into 10.0.0.0/24. Load this example in Merge mode above to see it computed live.

Related tools

Need detailed information about one resulting CIDR? Use the Subnet Calculator. Planning differently sized subnets? Use the VLSM Calculator. Dividing one network into equal-size child prefixes? Use the Subnet Splitter. Checking whether two networks conflict? Use the Subnet Overlap Checker. Aggregating a whole route table down to the fewest exact prefixes? Use the Route Summarization Calculator.