Subnet Mask / Wildcard / CIDR Converter
Enter any one of the three representations and all others update instantly. Covers all 33 valid IPv4 prefix lengths with binary breakdown and a full quick-reference table.
3-Way Converter — type in any field
CIDR Prefix /0 – /32
Total addresses: —
Subnet Mask dotted decimal
Wildcard Mask inverse mask
OPNsense, Palo Alto rules
| Field | Binary |
|---|---|
| Subnet Mask | |
| Wildcard |
Complete Reference — all 33 prefix lengths
| Prefix | Subnet Mask | Wildcard Mask | Usable Hosts | Total Addresses | Common Use |
|---|
Subnet Mask, Wildcard Mask, and CIDR Explained
All three representations describe the same thing — the boundary between the network and host portions of an IPv4 address — but they encode it differently depending on the context they're used in.
Subnet Mask
The subnet mask uses 1-bits for network bits and 0-bits for host bits. It is used by operating systems, DHCP servers, and routing protocols like OSPF and EIGRP to determine which part of an IP address identifies the network. Example: 255.255.255.0 for a /24.
Wildcard Mask
The wildcard mask is the bitwise inverse of the subnet mask — 0-bits match, 1-bits are "don't care". It is used in Cisco ACLs, OSPF network statements, and firewall rules on OPNsense, pfSense, Palo Alto, and Forcepoint. For a /24, the wildcard is 0.0.0.255.
CIDR Prefix Length
CIDR (Classless Inter-Domain Routing) notation simply counts the number of leading 1-bits in the subnet mask. It is the most compact representation and the standard for routing tables, cloud security groups (AWS, Azure, GCP), and modern firewall interfaces.
The Relationship
For any prefix /n: the subnet mask has n ones followed by 32−n zeros, and the wildcard mask has n zeros followed by 32−n ones. Subnet mask + wildcard mask always equals 255.255.255.255.