ACL helper

Wildcard Mask Calculator

Convert an IPv4 network and CIDR prefix into the wildcard mask used by Cisco ACLs, routing protocol network statements, and route filtering rules.

ACL-ready outputBuild standard and extended ACL entries faster.
Network summarySee the subnet mask and normalized network together.
IOS exampleGet a ready-to-read example for router configuration.

Calculate wildcard values

Enter a network like 192.168.10.0/24 or provide the network address and let the tool assume /24.

IPv4

Result preview

Your calculated network, subnet mask, wildcard mask, and ACL-style example will appear here.

Where wildcard masks are used

Access control lists

ACL entries usually pair a network address with a wildcard mask to match a host, subnet, or range of IP addresses.

Routing protocol statements

Protocols such as OSPF and EIGRP often use wildcard-based network statements when enabling interfaces inside a process.

Common defaults

If no prefix is included, this page assumes /24. That keeps the calculator fast for common lab and small-office examples.

How wildcard masks work

A wildcard mask is the inverse of a subnet mask. A zero bit means the matching bit must be the same, while a one bit means the matching bit can vary. For example, a /24 subnet mask is 255.255.255.0, so the matching wildcard mask is 0.0.0.255. Cisco IOS uses this format in many ACL and routing examples because it can describe a host, subnet, or broader address range compactly.

When you enter a CIDR prefix, the calculator normalizes the network address, calculates the subnet mask, inverts it to produce the wildcard mask, and shows an ACL-style example. This helps prevent mistakes such as using a host address where a network address is expected or copying a subnet mask into a field that requires a wildcard mask.

Host match

A single host uses wildcard 0.0.0.0. In ACL form, host 192.0.2.10 and 192.0.2.10 0.0.0.0 describe the same exact address match.

Subnet match

A /24 network such as 192.168.10.0/24 becomes wildcard 0.0.0.255. This is common in standard ACLs, extended ACLs, OSPF network statements, and EIGRP network statements.

Large range match

A /16 network such as 10.20.0.0/16 becomes wildcard 0.0.255.255. Always confirm the range before using broad matches in production ACLs or route filters.

Related tools and labs