Last updated
What a wildcard mask is
A wildcard mask tells a router access list which bits of an address must match. A 0 bit must match and a 1 bit is ignored. It is the subnet mask turned inside out, so the wildcard mask for 255.255.255.0 is 0.0.0.255.
With the network 192.168.10.0 and the wildcard 0.0.0.255, the first three numbers must match and the last one can be anything, so the rule covers 192.168.10.0 to 192.168.10.255.
Wildcard mask for each prefix
The wildcard is 255 minus each number of the subnet mask. These six cover the common cases, worked out by the same code as the calculator.
| Prefix | Subnet mask | Wildcard mask | Addresses matched |
|---|---|---|---|
| /24 | 255.255.255.0 | 0.0.0.255 | 256 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 |
| /0 | 0.0.0.0 | 255.255.255.255 | 4,294,967,296 |
The subnet mask cheat sheet shows the wildcard for every prefix from /0 to /32, and the CIDR calculator gives the range of a block. To plan subnets of different sizes, use the VLSM calculator.
Wildcard mask to subnet mask
Subtract each wildcard number from 255. The wildcard 0.0.0.63 gives the mask 255.255.255.192 (/26), 0.0.0.255 gives 255.255.255.0 (/24) and 0.0.15.255 gives 255.255.240.0 (/20). Switch Input is to Wildcard mask and type the wildcard to see the mask and prefix.
Access list lines
Give a network address and the calculator writes a router access list line. The network is cleared to the prefix first, and a /32 uses the word host and a /0 uses any:
- 192.168.10.0/24:
permit ip 192.168.10.0 0.0.0.255 any - 10.1.1.5/32:
permit ip host 10.1.1.5 any - 0.0.0.0/0:
permit ip any any
Syntax differs between devices, so check your own documentation.
Non-contiguous wildcards
A wildcard such as 0.0.255.0 has its 1 bits in more than one block. Some access lists accept it to match addresses that differ only in the third number, but it does not describe a subnet. The calculator shows the notice "Non-contiguous wildcard: valid in some ACLs, but it is not a subnet." and no prefix or mask.
Frequently asked questions
What is a wildcard mask?
A wildcard mask is a 32-bit pattern that says which address bits must match and which are ignored. A 0 bit must match and a 1 bit is ignored, so it is the inverse of a subnet mask. The wildcard mask for 255.255.255.0 is 0.0.0.255. Router access lists use it to match a range of addresses.
What is the wildcard mask for /24?
The wildcard mask for /24 is 0.0.0.255. Subtract each octet of the subnet mask 255.255.255.0 from 255 and you get 0.0.0.255. Other common ones: /30 is 0.0.0.3, /20 is 0.0.15.255 and /16 is 0.0.255.255. The calculator shows the wildcard, the mask and the prefix together.
How do I convert a wildcard mask to a subnet mask?
Subtract each wildcard octet from 255. The wildcard 0.0.0.63 gives 255.255.255.192, which is /26. The wildcard 0.0.15.255 gives 255.255.240.0, which is /20. Switch the input to Wildcard mask, type the wildcard, and the calculator shows the subnet mask and the prefix.
What wildcard mask matches one host, or any host?
The wildcard 0.0.0.0 matches exactly one host, because every bit must match. It is a /32, and access lists often write it as the word host. The wildcard 255.255.255.255 ignores every bit, so it matches any address. It is a /0, often written as the word any.
What does a wildcard like 0.0.255.0 mean?
It is a non-contiguous wildcard: the ones are not in one block, so it does not describe a subnet. Some access lists accept a pattern like this to match addresses that differ only in the third number. The calculator shows a notice instead of a prefix, because no subnet mask matches it.
How do I write an access list line with a wildcard mask?
A common router access list line is: permit ip 192.168.10.0 0.0.0.255 any. It permits traffic from every address in 192.168.10.0/24 to any destination. For a single host the line uses host, as in permit ip host 10.1.1.5 any. Syntax differs between devices, so check your own documentation.