Covered entry
A host or subnet entirely inside another allowed network adds no address coverage. Removing it simplifies review, although an attached comment or owner should be preserved elsewhere.
IP Allowlist Cleaner
Paste an IPv4 allowlist to remove repeated entries, normalize host addresses, collapse covered networks, and summarize adjacent ranges without granting any address that was not already present.
Nothing is uploaded. The output preserves exact IPv4 coverage and does not broaden the list.
Normalize the allowed address set
Enter one IPv4 host or CIDR per line. Commas and spaces are also accepted. Comments beginning with # are removed before parsing.
Adjacent coverage is summarized only when the replacement contains exactly the same addresses.
Exact minimization has a strict boundary
The cleaner converts every valid entry into an address interval, merges intervals that overlap or touch, then expresses the union as the smallest exact set of CIDRs. It never replaces two ranges with a broader supernet that would include an address absent from the input.
Adjacent entry
Neighbors can be summarized when binary alignment permits exact CIDR coverage. If they do not form an exact larger block, the output retains multiple CIDRs.
Meaning is not preserved automatically
Two technically mergeable entries may have different owners, expiry dates, or business purposes. Keep that policy metadata even when the address representation is shorter.
Review the output before replacing policy objects
Normalization reduces address-list complexity, but it cannot inspect references, rule order, object names, identity controls, or vendor syntax. Compare the before and after address counts, preserve approval records, and test both intended and blocked sources after implementation.
Keep policy meaning outside the CIDR list
An address set should not be the only record of why access exists. Retain the service owner, business purpose, approval, review date, and expected traffic beside the normalized output. If neighboring ranges have different expiry dates or owners, separate objects may remain clearer even when they can be summarized exactly.
Approve the change with coverage evidence
| Check | Expected evidence | Reason |
|---|---|---|
| Address count | Before and after totals are equal | Confirms the cleaned set neither grants nor removes an address |
| Object references | Rules, groups, and systems that use the list are identified | Prevents a safe calculation from becoming an unsafe deployment |
| Ownership and expiry | Every retained purpose has an owner and review date | Stops unrelated exceptions from losing their accountability |
- Export the current list and policy before editing it.
- Keep rejected lines visible until an owner resolves them.
- Compare one intended allowed source and one address immediately outside each boundary.
- Use the firewall rule planner to preserve approval, rollback, and verification steps.
Use the right next check
Run proposed entries through the CIDR overlap checker when separate zones must not share space. Use the firewall rule conflict checker when address cleanup may change how ordered rules interact.
The calculation follows CIDR prefix rules from RFC 4632. It is a local planning result, not a deployed firewall change.