How to Convert an IP Range to CIDR Blocks

Firewalls, cloud security groups, and routing tables rarely accept “from address A to address B” — they accept CIDR blocks. Converting an IP range into the smallest set of CIDR blocks that covers it exactly is a routine but surprisingly error-prone task. This guide explains the rules behind the conversion and walks through the edge cases.

What an IP range is

An IP range is simply a start address and an end address, with every address in between included: 192.168.1.0 – 192.168.1.255 means all 256 addresses in that block. Ranges are continuous by definition — there is no way to express “these addresses except that one” as a single range.

What CIDR notation means

CIDR notation describes a block with a network address and a prefix length: 192.168.1.0/24 is the block of 256 addresses starting at 192.168.1.0. Two rules make CIDR stricter than a plain range: the block size must be a power of two (2, 4, 8, 16… addresses), and the network address must align to that size — a /26 block (64 addresses) can only start at an address divisible by 64.

Why ranges are converted to CIDR

Firewalls and security groups: AWS security groups, Azure NSGs, and most firewall products take CIDR blocks, not arbitrary ranges.
Routing tables: static routes and BGP announcements are prefixes.
Allowlists: WAF rules and VPN policies match traffic against CIDR lists — vendor-published IP lists often arrive as ranges and must be translated.

How IP range to CIDR conversion works

The standard method walks forward from the start address and repeatedly takes the largest valid block available:

At the current address, find the largest block that aligns to it.
Shrink that block if it would run past the end of the range.
Emit the block, move to the address after it, and repeat.

This greedy approach is guaranteed to produce the fewest blocks, and it never emits a block that covers an address outside the requested range.

Why one range may require multiple CIDR blocks

A range that does not start on a block boundary, or whose size is not a power of two, cannot be expressed as one CIDR block. Consider 192.168.1.10 – 192.168.1.20: 11 addresses. No single power-of-two block aligned at 192.168.1.10 can hold it, so the conversion produces four blocks — 192.168.1.10/31, 192.168.1.12/30, 192.168.1.16/30, and 192.168.1.20/32 — exactly 11 addresses, nothing more.

Step-by-step examples

Example 1 — a full /24

192.168.1.0 to 192.168.1.255 is 256 addresses starting on a clean boundary, so it converts to the single block 192.168.1.0/24.

Example 2 — a /25

192.168.1.0 to 192.168.1.127 is 128 addresses, aligned at zero, so it becomes 192.168.1.0/25.

Example 3 — an unaligned range

192.168.1.10 to 192.168.1.20: the start is not aligned to any block larger than /31, so the conversion emits the four blocks above. A common mistake here is emitting 192.168.1.10/28, which also covers 192.168.1.0 – 192.168.1.9 and 192.168.1.21 – 192.168.1.25 — addresses you never asked to include.

Common mistakes

Rounding up to a familiar block. Using /24 because the range “looks like a /24” silently widens your firewall rule to addresses you never allowed.
Ignoring alignment. 192.168.1.4 – 192.168.1.7 is a /30, but 192.168.1.6 – 192.168.1.9 is not a single /30 because 192.168.1.6 is not aligned to a 4-address boundary.
Off-by-one on the end address. Treating the range as exclusive at the end, or including one address too many, changes every block in the result.
Forgetting the fewest-blocks goal. Splitting a clean /24 into 256 /32s is valid but produces unusable rule lists.

Network, firewall, and cloud use cases

Cloud security groups: translating a vendor’s IP range list into ingress rules.
Routing: installing the smallest set of static routes that covers a range without a default route.
WAF allowlists: whitelisting an office’s dynamic ISP range with the minimum number of entries.
VPN policies: matching remote-site subnets exactly so tunnels only carry intended traffic.

FAQ

Is one CIDR block always enough?

No. Only ranges that start on a proper boundary and have a power-of-two size convert to a single block.

Can I use a bigger block to reduce the number of rules?

Only if you are willing to allow the extra addresses it covers. In firewall contexts that usually means widening your attack surface.

What if my range covers 0.0.0.0 – 255.255.255.255?

The whole IPv4 space is a single aligned power-of-two block: 0.0.0.0/0.

How do I check the result is correct?

Sum the address counts of the emitted blocks — they must equal end minus start plus one, and no block may reach outside the range.

Convert an IP range with our IP Range to CIDR Converter

Enter a start and end address and get the smallest exact set of CIDR blocks instantly.

IP Range to CIDR Converter