---
title: Which IPs does this allowlist cover? How to calculate CIDR ranges with the CIDR Calculator
description: A vendor tells you to allowlist 140.82.112.0/20, and your firewall wants a start and end address, a netmask or a list of /24s. To calculate a CIDR range, keep the first N bits of the address and vary the rest: a /20 is 4,096 addresses from 140.82.112.0 to 140.82.127.255. Here's how to get the range, masks and splits in one step with the free CIDR Calculator, and a Python one-liner that checks it.
canonical: https://watchfor.io/blog/how-to-calculate-cidr-ranges
---

# Which IPs does this allowlist cover? How to calculate CIDR ranges with the CIDR Calculator

2026-10-04 · WatchFor Team · Guides · guides, networking, security

A vendor tells you to allowlist 140.82.112.0/20, and your firewall wants a start and end address, a netmask or a list of /24s. To calculate a CIDR range, keep the first N bits of the address and vary the rest: a /20 is 4,096 addresses from 140.82.112.0 to 140.82.127.255. Here's how to get the range, masks and splits in one step with the free CIDR Calculator, and a Python one-liner that checks it.

To calculate a CIDR range, keep the first N bits of the address (the number
after the slash) and let the remaining bits run from all zeros to all ones.
The all-zeros address is the start of the range, the all-ones address the
end, and the block holds 2^(32−N) addresses. `140.82.112.0/20` keeps 20
bits and frees 12, so it covers 4,096 addresses, from `140.82.112.0` to
`140.82.127.255`.

The free [CIDR Calculator](/cidr-calculator) turns any block into its
network and broadcast address, first and last usable host, subnet and
wildcard masks and host count, and splits it into smaller prefixes. It runs
in your browser. No signup.

## What this tool answers

*What exactly does this CIDR block cover, and how do I write it the way my
system wants?* Reach for it when a vendor publishes IP ranges to allowlist
(webhooks, monitoring probes, CDNs), when a firewall or router only accepts
masks or smaller blocks, when you audit a security-group rule someone else
wrote, or when you need to know whether one address falls inside a range.

## A real example

### Calculating a CIDR range for a firewall allowlist

GitHub sends webhooks from published ranges, which it lists in its meta API
(`https://api.github.com/meta`, key `hooks`). When we fetched it, the list
was `192.30.252.0/22`, `185.199.108.0/22`, `140.82.112.0/20`,
`143.55.64.0/20` and two IPv6 blocks. Suppose your firewall only accepts
`/24` entries, or a start and end address. What does `140.82.112.0/20` turn
into, and does it include the address `github.com` resolved to for us,
`140.82.121.4`?

In the [CIDR Calculator](/cidr-calculator) we pasted `140.82.112.0/20`,
switched to **Advanced** and, in the splitter, picked **/24 × 16 subnets**:

![The CIDR Calculator for 140.82.112.0/20 in Advanced mode: summary 140.82.112.0/20 labelled Public with 4,094 usable hosts from 140.82.112.1 to 140.82.127.254, network address 140.82.112.0, broadcast 140.82.127.255, subnet mask 255.255.240.0, wildcard mask 0.0.15.255, 4,096 total and 4,094 usable addresses](/blog/how-to-calculate-cidr-ranges-result.webp)

The block runs from `140.82.112.0` to `140.82.127.255`: 4,096 addresses,
4,094 usable as hosts. The mask is `255.255.240.0`, the wildcard
`0.0.15.255`. Further down, the splitter lists it as sixteen /24s,
`140.82.112.0/24` through `140.82.127.0/24`, which is what a /24-only
firewall needs:

![The subnet splitter of the CIDR Calculator set to /24 × 16 subnets: rows 1 to 16 from 140.82.112.0/24 to 140.82.127.0/24, each with its usable range (for example 140.82.112.1 – 140.82.112.254), broadcast address and 254 usable hosts](/blog/how-to-calculate-cidr-ranges-split.webp)

Row 10, `140.82.121.0/24`, holds `140.82.121.4`: the address falls inside,
because its third octet, 121, is between 112 and 127.

**The answer:** one `/20` rule, or the range `140.82.112.0–140.82.127.255`,
or sixteen `/24` entries all cover exactly the same addresses. Use whichever
your firewall accepts. Repeat for the other three IPv4 blocks, add the IPv6
ones if your service is reachable over IPv6, and re-fetch the meta API now
and then, because published ranges change.

## How to read the results

| Field | What it means for a range |
| --- | --- |
| **Summary (e.g. 140.82.112.0/20)** | The block in canonical form. If you paste an address from the middle, it snaps to the real start: `140.82.121.4/20` becomes `140.82.112.0/20`. |
| **Usable hosts / range** | First and last address you can assign to a machine. For allowlists use the full range, network to broadcast. |
| **Type badge** | Public, Private, CGNAT, Loopback… A *Private* range in a vendor's public list is a typo. |
| **Network address** | Start of the range. |
| **Broadcast address** | End of the range. |
| **Subnet mask** | The prefix as dotted decimal, for systems that take `address + mask`. |
| **Wildcard mask** | The inverted mask, `0.0.15.255` for a /20, for Cisco ACLs: `permit ip 140.82.112.0 0.0.15.255 any`. |
| **Addresses** | Total and usable count. Double-check the total before allowlisting: a typo of `/12` instead of `/20` covers 256 times more. |
| **Splitter** (Advanced) | Splits the block into 2, 4, 8… equal smaller blocks and lists each network, range and broadcast. It shows the first 64 rows. |

## More ways to use it

- **Audit a security group.** A rule allowing `0.0.0.0/0` is the whole
  internet; `10.0.0.0/8` is 16.7 million private addresses. Paste each rule
  in and check the total is what was intended.
- **Plan a VPC.** Start from a `/16`, split it into `/20`s per environment
  or availability zone, then into `/24`s per tier.
- **Translate for a legacy device.** Routers and appliances that want
  `network mask` pairs, or Cisco ACLs that want wildcards, get both from one
  paste.
- **Check one address against a range.** Enter the address with the range's
  prefix (`140.82.121.4/20`). If the summary snaps to the range's network
  address, the address is inside.
- **Allowlist monitoring probes.** The same method applies to any vendor's
  range list, including [WatchFor's probe addresses](/docs/reference/probe-locations#allowlisting-watchfor). For subnets of a LAN, the
  [subnet guide](/blog/how-to-calculate-a-subnet) covers masks and gateways.

## Tips and gotchas

- **The network address must line up.** `140.82.120.0/20` isn't a valid
  block start; the /20 that contains it starts at `140.82.112.0`. Some
  systems reject a misaligned entry, others silently round it, and the
  calculator shows which block you really get.
- **Every step is a factor of two.** /24 = 256, /23 = 512, /22 = 1,024,
  /21 = 2,048, /20 = 4,096. You can't express 3,000 addresses as one block.
- **Not all "hosts" matter for allowlists.** Network and broadcast addresses
  only matter on a LAN. On a firewall, allow the whole block.
- **Don't forget IPv6.** A service with an AAAA record accepts connections
  over IPv6, and an IPv4-only allowlist won't cover them. Use the
  [IPv6 Subnet Calculator](/ipv6-subnet-calculator) for those blocks.
- **Ranges change.** Cloud and SaaS ranges move. Prefer the vendor's
  machine-readable list (and automation that refreshes it) over a pasted
  copy.

## Check it from the command line too

Python's `ipaddress` module does the same arithmetic:

```bash
python3 -c "
n = ip.ip_network('140.82.112.0/20')
print(n.netmask, n.hostmask, n.broadcast_address, n.num_addresses)
print(ip.ip_address('140.82.121.4') in n)
print(*n.subnets(new_prefix=24), sep='\n')" | head -5
```

```text
255.255.240.0 0.0.15.255 140.82.127.255 4096
True
140.82.112.0/24
140.82.113.0/24
140.82.114.0/24
```

Mask, wildcard (`hostmask`), end address and size match the calculator,
`True` confirms the address is inside, and the split starts the same way
(trimmed with `head`; it continues to `140.82.127.0/24`). To pull the current
ranges straight from the source:

```bash
curl -s https://api.github.com/meta | jq -r '.hooks[]'
```

```text
192.30.252.0/22
185.199.108.0/22
140.82.112.0/20
143.55.64.0/20
2a0a:a440::/29
2606:50c0::/32
```

## FAQ

**How do I convert a CIDR to an IP range?**
The start is the address with all host bits set to 0, the end the same with
all host bits set to 1. For `140.82.112.0/20` that's `140.82.112.0` to
`140.82.127.255`. Paste any block into the calculator to see both.

**How many IP addresses are in a /20?**
4,096 (2^12), of which 4,094 are usable as hosts on a LAN. A /16 has 65,536,
a /24 has 256, a /32 is one address.

**What does /0 mean in CIDR?**
No fixed bits: every IPv4 address. `0.0.0.0/0` in a firewall rule means "from
anywhere". See [what is a firewall](/blog/what-is-a-firewall) and
[what is an IP address](/blog/what-is-an-ip-address) for the background.

---

Canonical page: https://watchfor.io/blog/how-to-calculate-cidr-ranges · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt