IPv4 · IPv6 · bulk input
CIDR to IP range calculator.
Turn a CIDR block into explicit start and end addresses — the form most firewall rules, allow-lists and legacy appliances expect. Paste a whole batch of CIDR ranges at once.
Address ranges
Results appear here as you type.
Where the boundaries come from
A prefix length is a count of leading bits that are fixed. Everything after it is free to vary, and those varying bits define the range.
So the arithmetic is mechanical: set every host bit to 0 for the first address, set every host bit to 1 for the last, and the size is 2^(32 − prefix) for IPv4 or 2^(128 − prefix) for IPv6.
If you type a block with host bits already set — 10.0.4.9/22 — it is normalised down to its network address first, because that is what routing hardware does with it too.
10.0.4.0/22 in binary
prefix 00001010.00000000.000001 00.00000000
└──────────┘
10 host bits
first 00001010.00000000.00000100.00000000 → 10.0.4.0
last 00001010.00000000.00000111.11111111 → 10.0.7.255
size 2^10 → 1,024The vertical break sits after bit 22. Nothing to its left ever changes inside this block.
Questions people actually ask
How do I work out an IP range from a CIDR block by hand?
The first address is the block itself with all host bits set to zero. The last is the same block with every host bit set to one. For 10.0.4.0/22 the prefix covers 22 bits, leaving 10 host bits, so the range is 10.0.4.0 through 10.0.7.255 — 1,024 addresses.
Is the first address in the range usable?
In IPv4 the first address of a subnet is the network address and the last is the broadcast address, so neither is assigned to a host. This converter reports the full block boundaries; the main calculator also shows the narrower first-and-last usable host range.
Can I convert several blocks at once?
Yes — paste as many as you like, one per line. Mixed IPv4 and IPv6 is fine. The Copy as TSV button gives you block, first address, last address and count as tab-separated columns, which pastes straight into a spreadsheet.
Why do some firewalls want a range instead of a CIDR block?
Older appliances and some cloud security-group APIs only accept explicit start and end addresses, because they match on integer comparison rather than prefix length. Converting is lossless in that direction — every CIDR block is a contiguous range, though the reverse is not always true.