Wildcard Mask Calculator — subnet mask ⇄ wildcard, ACL & OSPF lines
Convert a prefix or subnet mask to a wildcard mask and back, see what a non-contiguous wildcard really matches, and build Cisco ACL / OSPF network lines plus YAMAHA RTX ip filter and iptables equivalents.
🔒 Runs entirely in your browser. Your input and output are never sent to a server or stored — fully private.
ACL line builder
Common masks
Click a row to use it.
| Prefix | Subnet mask | Wildcard | Addresses |
|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 |
| /12 | 255.240.0.0 | 0.15.255.255 | 1,048,576 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 |
A wildcard mask is the bitwise inverse of a subnet mask: 0 bits must match, 1 bits are ignored. 0.0.0.0 means one host (the keyword host), 255.255.255.255 means any. Cisco ACLs and OSPF/EIGRP network statements use wildcards; route and interface masks do not.
About this tool
This wildcard mask calculator converts between prefix length, subnet mask and wildcard (inverse) mask, and shows exactly which addresses a wildcard matches — including non-contiguous wildcards that a plain subnet calculator cannot explain. Give it an address and it normalises the entry the way a router would, warns when host bits are set, and builds ready-to-paste lines for Cisco IOS standard, extended and named ACLs and the OSPF network statement, with the matching YAMAHA RTX ip filter and Linux iptables rules. Everything runs in your browser.
Frequently asked questions
What is a wildcard mask, and how is it different from a subnet mask?
A wildcard mask tells a router which bits of an address to compare: a 0 bit must match, a 1 bit is ignored. That is the bitwise opposite of a subnet mask, where 1 bits mark the network part. So /24 is 255.255.255.0 as a subnet mask and 0.0.0.255 as a wildcard. Subnet masks describe what a network is (interfaces, routes); wildcard masks describe what a rule should match, which is why Cisco ACLs and the OSPF and EIGRP network commands use them.
How do I convert a subnet mask to a wildcard mask in my head?
Subtract each octet from 255. 255.255.255.224 becomes 0.0.0.31, 255.255.240.0 becomes 0.0.15.255, and 255.255.255.252 becomes 0.0.0.3. For a contiguous mask the last non-zero wildcard octet is always one less than the block size (32 − 1 = 31), and the number of matching addresses is 2 to the power of the count of 1 bits in the wildcard. The reference table in the tool lists every common prefix with both forms.
Can a wildcard mask be non-contiguous, and what does it match?
Yes. Cisco ACLs accept any bit pattern, because each bit is checked independently. 192.168.1.0 0.0.0.254 matches every address in 192.168.1.0/24 whose last bit is 0 — the 128 even addresses — and 10.0.0.5 0.255.0.0 matches the host .0.5 in every 10.x.0.0 network. That is powerful but hard to read, and YAMAHA RTX filters, iptables, prefix lists and route masks cannot express it, so this tool lists sample matches and tells you when a rule has to be split into contiguous blocks instead.
Why did the router change the address in my ACL entry?
Because the address had bits set in positions the wildcard ignores. If you type permit 192.168.10.5 0.0.0.255, the last octet is irrelevant to the match, so Cisco IOS stores it as 192.168.10.0 0.0.0.255 and the rule matches the whole /24 — not the single host you probably meant. The calculator shows the normalised network and warns when this happens. To match one host use the wildcard 0.0.0.0, which IOS writes as host 192.168.10.5.
What does the wildcard in an OSPF network statement actually do?
It selects interfaces, not prefixes to advertise. OSPF is enabled on every interface whose primary IP address matches the address and wildcard, and that interface's connected subnet is then advertised with its real mask. network 10.0.0.0 0.255.255.255 area 0 turns OSPF on for every 10.x interface; network 10.1.1.1 0.0.0.0 area 0 turns it on for exactly the interface with that IP, which is the most precise and commonly recommended style. Using the interface command ip ospf 1 area 0 avoids wildcards altogether.