IP Range to CIDR
Firewall and ACL rules take prefixes, not ranges. This works out the minimal set of prefixes covering an arbitrary range, which is rarely the single block people expect.
| CIDR | First | Last | Count |
|---|---|---|---|
Why one range is rarely one prefix
A CIDR block must start on a power-of-two boundary and be a power-of-two long. An arbitrary range almost never satisfies both, so it decomposes into a set of blocks — largest that fits, then repeat.
192.0.2.5–192.0.2.130 looks like it should be about a /25. It is
actually eight separate prefixes, because the start address is not aligned. Moving the start to
.0 and the end to .255 collapses the
whole thing to a single /24.
This matters when a rule set has a limit on entries, or when a vendor charges per ACL line. If you are producing more blocks than expected, the fix is usually to widen the range slightly to the nearest boundary — provided the extra addresses are yours to include.