ACCESS CONTROL

Wildcard Mask Calculator | ACL Wildcard

04/ 06

Convert a CIDR prefix or subnet mask to a wildcard mask and calculate the network pair used in ACL rules.

Calculator inputs

IPv4

Calculation results

NETWORK ADDRESS

192.168.1.0/24

254usable addresses

Subnet mask: 255.255.255.0
Broadcast: 192.168.1.255
First host: 192.168.1.1
Last host: 192.168.1.254
Wildcard mask: 0.0.0.255
Total addresses: 256

ACL address / wildcard pair192.168.1.0 0.0.0.255

Mathematical range excluding network and broadcast. Verify assignability for special-purpose address space.

CIDR quick reference

Common network sizes

CIDR	Mask	Hosts
/16	255.255.0.0	65,534
/24	255.255.255.0	254
/25	255.255.255.128	126
/26	255.255.255.192	62
/27	255.255.255.224	30
/28	255.255.255.240	14
/29	255.255.255.248	6
/30	255.255.255.252	2
/31	255.255.255.254	2*
/32	255.255.255.255	1

* /31: point-to-point links

Verify your environment and policies
before applying changes to devices.

HOW IT WORKS

Convert a subnet mask to an ACL wildcard

A wildcard mask is the bitwise inverse of the subnet mask. Subtract the mask from 255.255.255.255: a /24 becomes 0.0.0.255.

In an ACL wildcard, a zero bit must match and a one bit is ignored. The pair 192.168.1.0 0.0.0.255 represents the entire /24.

This tool only derives wildcard masks from contiguous subnet masks. Verify device-specific ACL syntax, direction, services and permit/deny policy separately.

RFC 950 · Subnetting ↗

FAQ

Frequently asked questions

Can I enter /24 directly?

Yes. Enter /24, 24 or 255.255.255.0.

Is 255.0.255.0 a valid subnet mask?

Not in this calculator. A subnet mask must have contiguous one bits starting from the left.

Is the result a complete device command?

The result is an address/wildcard pair. It is not a complete policy command; check the vendor syntax and intended direction.