Convert a subnet mask or prefix to a Cisco wildcard mask, or check any ACL address and wildcard, including noncontiguous ones, and test which addresses it matches.
Cisco access control lists (ACLs) don't use subnet masks. They use a wildcard mask, also called an inverse mask. In a wildcard mask, each 0 bit means “this bit must match” and each 1 bit means “ignore this bit.”
Most wildcard masks are a subnet mask turned inside out, so they match one block of addresses. Cisco ACLs also accept wildcard masks whose bits aren't contiguous. Those match a pattern rather than one block, such as every even-numbered subnet. This calculator handles both kinds. It explains matching only; it doesn't write or apply configuration.
Your input stays in your browser. The calculation runs there, and what you type isn't sent to this site or anyone else, isn't saved, and isn't added to the page address. Your browser's own features, such as form autofill and extensions, are outside this site's control. On a shared computer, clear anything sensitive before you walk away.
This calculator needs JavaScript. Turn it on for this page to use the calculator; the explanation below works without it.
Results
Each octet
First matched blocks
Test an address
How to read the results
- Wildcard mask: for a subnet mask, subtract it from 255.255.255.255, octet by octet. That's the method in Cisco's Configure IP Access Lists. It works for subnet masks, which are always contiguous.
- A 0 bit must match and a 1 bit is ignored. So
0.0.0.255means “the first three octets must match; the last can be anything.” - ACL address and wildcard is the pair you'd see in an ACL entry.
0.0.0.0as a wildcard means one exact address (Cisco'shostkeyword);255.255.255.255means any address (theanykeyword). - Contiguous or noncontiguous: a contiguous wildcard matches one block, which is also a CIDR prefix. A noncontiguous wildcard matches a pattern spread across separate blocks. Both are valid in Cisco IPv4 ACLs, but noncontiguous ones are easier to misread, so check the pattern and the count.
- Addresses matched is everything the pair covers. Check it before you change an ACL; an entry that matches more than you meant is a common way to open or block too much.
- This calculator only describes ACL matching. Other places that use wildcard masks may follow different rules. Check the documentation for the feature you're configuring.
Example: 192.168.10.37 with 255.255.255.224 (/27)
- Wildcard mask: 255.255.255.255 − 255.255.255.224 = 0.0.0.31 (contiguous)
- ACL address and wildcard: 192.168.10.32 0.0.0.31
- Matches 192.168.10.32 to 192.168.10.63 (32 addresses), the same as 192.168.10.32/27
192.168.10.37 is inside that range. ACL entries are normally written with the range's first address, 192.168.10.32.
Example: a noncontiguous wildcard, 10.0.0.0 0.0.254.255
- Wildcard in binary:
00000000.00000000.11111110.11111111 - Pattern (x = ignored):
00001010.00000000.xxxxxxx0.xxxxxxxx - In words: the first octet is 10, the second is 0, the third is any even number (0, 2, 4 … 254), and the fourth is anything.
- Matches 10.0.0.0/24, 10.0.2.0/24, 10.0.4.0/24 … 10.0.254.0/24: 128 separate blocks of 256, or 32,768 addresses.
10.0.4.9 matches: its third octet, 4, is even. 10.0.5.9 doesn't: 5 is odd. 10.1.4.9 doesn't either: the second octet must be 0.
Why: in the third octet the wildcard is 254, or 11111110 in binary. Only the last bit is a 0, so only that bit is checked. The address has a 0 there, so the entry matches only third octets whose last bit is 0: the even numbers. The first two octets are all 0 bits in the wildcard, so they must match exactly. The fourth octet is all 1 bits, so it's ignored.
Why a noncontiguous wildcard has no single range
A noncontiguous wildcard can't be written as a single CIDR prefix, and it doesn't cover one unbroken first-to-last range. 10.0.0.0 0.0.254.255 skips every odd third octet, so the addresses it matches have gaps between them. Covering the same addresses with prefixes would take 128 separate /24 entries. That's why the calculator shows a pattern, a count and the first few blocks instead of a range.
Your address and ignored bits
Bits of the address that sit under a 1 in the wildcard are ignored. So 10.0.2.0 0.0.254.255 matches exactly the same addresses as 10.0.0.0 0.0.254.255. If your address has 1s in ignored positions, the calculator says so and shows the pattern with those bits cleared. One checked bit can change the meaning: 10.0.1.0 0.0.254.255 matches every odd third octet instead.
What the calculator accepts
The mask type decides how the mask field is read. As a subnet mask or prefix, it takes a prefix length from /0 to /32 or a dotted mask whose 1 bits are contiguous; anything else, such as 255.255.0.255, is refused as a subnet mask. As a wildcard mask, it takes any four numbers from 0 to 255 and never refuses one for being noncontiguous. In both modes, numbers above 255, leading zeros such as 010 (some systems read them as octal), and stray spaces or characters are refused, so a typo can't quietly change the result.
What this looks like in an ACL
Illustrative only. This shows where an address and wildcard pair appears in a Cisco IOS standard access list. It isn't a recommended configuration, and this page doesn't generate or apply commands. For the full syntax and how to apply an ACL to an interface, see Cisco's Configure IP Access Lists.
! Illustrative only. Not a recommended configuration.
access-list 10 permit 192.168.10.32 0.0.0.31
access-list 10 permit 10.0.0.0 0.0.254.255Cisco's IP Access List Overview states that “unlike subnet masks, which require contiguous bits indicating network and subnet to be ones, wildcard masks allow noncontiguous bits in the mask.” The IOS XE 17.x and IOS XR access list guides say the same.
Related reference
For a printable ACL reference, see the IOS IPv4 Access Lists cheat sheet by Jeremy Stretch in the PacketLife library. For where ACLs fit in a small network, see the network segmentation section of the Small Business Cybersecurity Checklist, and the basic firewall rules in Building a Reliable Home or Small Business Network. More networking guides are under Networking & Wi-Fi.
Standards and references
- Cisco: Configure IP Access Lists (Document 23602)
- Cisco IOS Security Configuration Guide: Access Control Lists, Release 12.4T (IP Access List Overview)
- Cisco Security and VPN Configuration Guide, Cisco IOS XE 17.x (IP Access List Overview, updated 2021-01-11)
- Cisco 8000 Series IP Addresses and Services Configuration Guide (IOS XR): Introduction to Access Control Lists
For how the IT Resource Center is researched, reviewed and corrected, see How These Guides Are Made.