Calculate an IP range from a CIDR block

Turn a CIDR block into its first and last usable address, broadcast address and host count before you write the firewall rule.

Open this example in CIDR Subnet Calculator

Open the tool, then paste the sample input below. Everything runs locally in your browser.

Open this example in CIDR Subnet Calculator →

The problem

A CIDR prefix hides the two numbers you actually need: where the block starts and where it stops. Getting them wrong by one address is how a security-group rule ends up excluding a host, or how two VPC subnets silently overlap.

Sample input

CIDR block
10.0.4.0/22

Expected output

Calculated range
Network:   10.0.4.0
Usable:    10.0.4.1 - 10.0.7.254
Broadcast: 10.0.7.255
Netmask:   255.255.252.0  (wildcard 0.0.3.255)
Hosts:     1,022 usable

How to do it

  1. Paste the CIDR block, for example 10.0.4.0/22.
  2. Read the usable host range and broadcast address from the result panel.
  3. Add a bare IP on the next line to check whether it falls inside the block.
  4. Set a split prefix to divide the block into equal subnets.
  5. Copy the range into your firewall rule, security group or IPAM record.

Common mistakes

  • Assigning the network or broadcast address to a host.
  • Assuming a /22 is four separate /24s that can be allocated independently without planning.
  • Mixing up the netmask and the wildcard mask in an ACL.
  • Overlapping two subnets because only the prefix, not the range, was checked.

Related tools

FAQ

How many hosts fit in a /22?

1,022 usable addresses. A /22 spans 1,024 addresses, and the network and broadcast addresses cannot be assigned to hosts.

What is the broadcast address of a block?

The last address in the range - every host bit set to 1. For 10.0.4.0/22 that is 10.0.7.255.

Can I check whether an IP is inside a block?

Yes. Put the block on the first line and the address on the second; the tool reports inside or outside and the host offset.

Is my IP data uploaded?

No. The calculation is integer arithmetic performed locally in your browser.

This guide uses browser-local tooling. Avoid pasting production secrets unless you understand what the tool displays and shares.

Explore related tools

Continue with adjacent browser-based tools for the same workflow.

View security and debugging tools →

Calculate an IP range from CIDR: quick answer

Use this when you are sizing a subnet, writing a firewall or security-group rule, or checking whether a client address belongs to a known internal block. Paste the CIDR block, read the usable range, and copy the exact first and last address into the rule rather than trusting the prefix alone.

What to verify

Check the broadcast address, the first and last usable host, and whether the block overlaps anything you have already allocated. For a /31 or /32, confirm your platform supports point-to-point or host-route semantics before relying on both addresses.

Recommended next steps