Wildcard Mask Calculator

Convert between subnet masks, CIDR prefixes and the inverted wildcard masks that Cisco ACLs and OSPF network statements expect.

Converter IP & Subnetting Runs in your browser
CIDR, "address mask", or a bare mask like 255.255.252.0.
Try:

Result

Wildcard mask
0.0.3.255
Subnet mask
255.255.252.0
CIDR prefix
/22
Network
10.20.28.0

Bit view

Mask (binary)
11111111.11111111.11111100.00000000
Wildcard (binary)
00000000.00000000.00000011.11111111
Bits matched
22 of 32
Addresses matched
1024
Cisco IOS
! Standard ACL entry
access-list 10 permit 10.20.28.0 0.0.3.255

! Extended ACL entry
ip access-list extended NETVORX-EXAMPLE
 permit ip 10.20.28.0 0.0.3.255 any

! OSPF network statement
router ospf 1
 network 10.20.28.0 0.0.3.255 area 0
MikroTik equivalent (uses CIDR, not wildcards)
/ip firewall address-list add list=EXAMPLE address=10.20.28.0/22

About Wildcard Mask Calculator

A wildcard mask is the bitwise inverse of a subnet mask. Where a subnet mask marks the bits that must match with ones, a wildcard mask marks the bits that are free to vary with ones. Cisco access lists, OSPF network statements and several other IOS features want the inverted form, and inverting octets in your head is where mistakes come from.

The arithmetic

Subtract each octet of the subnet mask from 255. A mask of 255.255.252.0 becomes 0.0.3.255. The quick check: the wildcard octets should sum with the mask octets to 255 in every position, and the number of trailing one-bits equals the number of host bits.

Where wildcards are used

Cisco standard and extended ACLs, OSPF and EIGRP network statements, and route-map match ip address clauses. Junos, RouterOS and Linux iptables/nftables all use CIDR notation instead, so no conversion is needed there - which is exactly why engineers moving between platforms get caught out.

Common use cases

  • Writing an ACL entry for a subnet you only have in CIDR form.
  • Adding an OSPF network statement that covers exactly one interface subnet.
  • Reviewing an inherited ACL to work out which range a wildcard actually matches.

Edge cases and gotchas

  • Non-contiguous wildcards (for example 0.0.0.255 applied at an odd offset) are legal in IOS and match discontiguous address sets - powerful, and a frequent source of accidental over-permitting.
  • OSPF network statements match interfaces, not routes: the wildcard is compared against interface addresses.

Frequently asked questions

What is the wildcard mask for a single host?
0.0.0.0 - every bit must match. IOS accepts the shorthand "host 10.1.1.1" for the same thing.
What does a wildcard of 255.255.255.255 mean?
Match anything - equivalent to "any" in an ACL, because no bits have to match.
Do Juniper and MikroTik use wildcard masks?
No. Both use CIDR prefixes throughout. Wildcards are a Cisco IOS convention, still present in NX-OS ACLs and IOS-XE.