Network
The first address after host bits are cleared. Firewall, route, and DHCP objects should use this boundary rather than an arbitrary member address.
IPv4 and IPv6 Subnet Calculator
Calculate an IPv4 or IPv6 CIDR locally, then confirm the result against the router, firewall, or cloud platform before applying a production rule.
Every calculation runs locally in this browser. FirewallGuide does not receive the addresses you enter.
Network bits11000000.10101000.00000001
Host bits.00001010
192.168.1.10/24
Choose the network question
Use one focused operation so the result answers the input you intended.
Returns the smallest exact set of CIDR blocks without including addresses outside the range.
Returns the smallest single block covering every supplied network. It can include additional addresses.
Read a CIDR result without guessing
The arithmetic defines a block. The network configuration determines whether that block belongs in the design.
Final address
The last address in the block. IPv4 commonly treats it as broadcast; IPv6 has no broadcast address.
Usable range
A conventional IPv4 host range. Point-to-point and special-purpose configurations can follow different platform rules.
Wildcard mask
The inverse of an IPv4 netmask. Some access-control and routing interfaces use it, but many do not.
Example: checking a proposed guest network
Entering 192.168.40.10/24 produces the network 192.168.40.0/24, a broadcast address of 192.168.40.255, and the conventional host range between them. This helps identify whether an address belongs to the intended guest segment and whether two proposed ranges overlap.
What to compare next
Compare the calculated network with DHCP settings, interface addresses, routes, and firewall objects. A correct mathematical range can still be wrong for the deployed topology if the gateway uses another prefix or the same range exists across a VPN.
Before using the result in a firewall or route
- Confirm the address and prefix from the authoritative interface or plan.
- Calculate the boundary and compare it with DHCP, router advertisements, and route objects.
- Check for overlap across local networks, tunnels, and cloud networks.
- Split only on a longer prefix and review the resulting number of networks before deployment.
When an address appears in integer, hexadecimal, or binary notation, normalize it with the IPv4 address converter before comparing records.
For access-control syntax that uses an inverse mask, calculate and test it with the wildcard mask calculator .
Use the calculated ranges in the network segmentation access matrix to define which zones should communicate.
For a routed gateway design, compare the result with the wired router topology and capacity checks before creating network objects.
IPv4 calculation
Shows netmask, wildcard mask, broadcast, conventional usable hosts, and binary network values.
IPv6 calculation
Shows the network, first and last address, expanded form, and block size. It does not invent an IPv6 broadcast address.
CIDR and subnet questions
What does the slash number mean?
The prefix length states how many leading IPv4 bits identify the network. A larger prefix creates a smaller address block.
Why are network and broadcast addresses excluded in many ranges?
Traditional IPv4 subnets reserve them to identify the subnet and reach every host. Special configurations can use different conventions, so verify the target platform.
Technical basis: IETF RFC 4632, Classless Inter-domain Routing.