Express an IP range as CIDR blocks
Allow-lists take CIDR notation — a start–end range splits into the minimal covering blocks.
Tools used in this guide
The job
Firewall and allow-list syntax wants CIDR blocks, but address ranges rarely align to powers of two. 10.0.0.15–10.0.0.40 can't be one block — it has to be split at binary boundaries into the smallest set that covers it exactly.
First and last address
Enter the start and end IPv4 addresses. The result is the ordered list of CIDR blocks — each aligned to its size — that tiles the range with no gaps and no extra hosts.
Worked example
192.168.1.10–192.168.1.23 is fourteen addresses, tiled by three blocks: 192.168.1.10/31 covers .10–.11, 192.168.1.12/30 covers .12–.15, and 192.168.1.16/29 covers .16–.23. The tail .16/29 is the nice catch — the last eight addresses happen to fall on a /29 boundary.
Where it stops
IPv4 only and capped at 128 output blocks — a sprawling range like 10.0.0.1–10.0.255.254 tiles fine, but millions of addresses across many bit boundaries can exceed the block cap and need summarizing by hand.