# Wildcard Mask Calculator – CIDR to Cisco ACL

> Convert CIDR prefixes to wildcard masks and back for Cisco ACLs and OSPF. Bidirectional conversion, inverse-mask math, ACL examples and a common-prefix table.

- Page URL: https://itinsighthub.com/wildcard-mask-calculator/
- Markdown variant of this page: append `?format=md` to any URL on this site or send `Accept: text/markdown`.
- Full site index for AI assistants: https://itinsighthub.com/llms.txt
- Full site export: https://itinsighthub.com/llms-full.txt

# Wildcard Mask Calculator

Convert between CIDR prefixes, dotted-decimal subnet masks and Cisco-style wildcard masks — in both directions.

## Results for /26

255.255.255.192 is the /26 subnet mask; its wildcard mask is 0.0.0.63.

- **Input interpreted as:** prefix length
- **Subnet mask:** 255.255.255.192
- **Wildcard mask:** 0.0.0.63
- **Prefix length:** /26
- **Total addresses:** 64
- **Usable hosts:** 62
- **Network base:** 198.51.100.0 (example network)
- **Broadcast address:** 198.51.100.63 (example network)
- **Mask → wildcard:** bitwise NOT of 255.255.255.192 = 0.0.0.63
- **Wildcard → mask:** bitwise NOT of 0.0.0.63 = 255.255.255.192

### Cisco ACL example

The wildcard tells the router which address bits matter: `0` bits must match exactly, `1` bits are ignored.

Cisco ACL example

```
access-list 100 permit ip 198.51.100.0 0.0.0.63 any
```

### Same prefix at a glance

*Common prefix lengths: mask and wildcard pairs*

| Prefix | Subnet mask | Wildcard mask | Addresses |
| --- | --- | --- | --- |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 |

## How wildcard masks work

A wildcard mask is the bitwise inverse of a subnet mask: every `1` in the mask becomes `0` in the wildcard and vice versa. Cisco IOS uses wildcards in extended and standard access lists (`access-list`), in OSPF `network` statements, and in route-map match clauses.

- A wildcard `0.0.0.255` means “the first three octets must match, the last octet can be anything.”
- A wildcard `0.0.0.0` matches exactly one address — equivalent to the `host` keyword.
- A wildcard `255.255.255.255` matches every address, the same as the `any` keyword.
- Converting back and forth never loses information: `NOT(NOT(x)) = x`.

To size the matching block instead, run the same input through the [IPv4 subnet calculator](https://itinsighthub.com/subnet-calculator/), or grab the full mapping from the [printable cheat sheet](https://itinsighthub.com/subnet-cheat-sheet/).

---

© 2026 ITInsightHub · [About](https://itinsighthub.com/about/) · [Contact](https://itinsighthub.com/contact/) · [Privacy](https://itinsighthub.com/privacy/)