redzilla
All tools
Diagnostics

CIDR to Regex & Range

Paste a CIDR subnet and I generate a regular expression matching exactly its IPs, the range (first–last), the total and examples. Great for grep on logs, ACLs and rules.

IPv4 with prefix, e.g. 192.168.1.0/24 or 10.0.0.0/8.

Examples
redzilla.cl — cidr2regex
 

Regular expression

Anchored with ^…$ and dots escaped. Use it in grep -E, egrep or log filters.

First
Last
Mask
Prefix
/24
255.255.255.0
Addresses
256
254 usable hosts
Range
192.168.1.0
— 192.168.1.255

Tested examples

IPMatches?Note

Checked against the regex itself in your browser.

How to use it · grep, ACLs and filters

Runs locally in your browser · no sign-up · nothing leaves your browser

How it works

The tool takes an IPv4 subnet in CIDR notation (for example 192.168.1.0/24) and generates a regular expression anchored with ^…$ that matches exactly the addresses in the block, no more and no fewer. It also returns the full range (first and last address), the dotted-decimal mask, the total address count (2^(32−prefix)) and the usable hosts.

To build the regex it first computes the network address and broadcast of the block, then breaks each octet down into exact sub-patterns by digit count (units, tens and hundreds), merging complete tens into classes such as 1\d\d. Every example in the table is verified against the generated regex in your browser, so what you see is tested, not assumed.

Example: regex for 192.168.1.0/26

  1. The /26 block has 2^(32−26) = 64 addresses: from 192.168.1.0 to 192.168.1.63, with mask 255.255.255.192.
  2. The first three octets are fixed (192, 168 and 1); only the last one varies, from 0 to 63.
  3. The 0–63 range breaks down into [1-9]?\d (0–9 plus the merged tens 10–59) and 6[0-3], so the final regex is ^192\.168\.1\.([1-9]?\d|6[0-3])$, ready for grep -E.

Frequently asked questions

How do I filter a log by a whole subnet with grep?
Generate the regex for the block and use it with extended grep: grep -E '^10\.0\.0\.…$' access.log. If the IP is not alone on the line (for example in an Apache log), remove the ^ and $ anchors; the tool shows both variants in the usage section.
Why does the regex start with ^ and end with $?
Anchoring prevents partial matches: without it, the pattern for 10.0.0.0/8 would also match inside 110.0.0.5 or 10.0.0.500. With ^…$ the expression only accepts lines that are exactly one IP of the block.
What is the difference between using the regex and using the IP range?
They are two ways of expressing the same block. The regex works where you only have text matching (grep, log filters, regex-based WAF rules); the first–last range and the mask work where the system understands networks (ACLs, firewalls, route lists). The tool gives you both so you can use whichever your platform accepts.
Does the tool send the subnets I type to any server?
No. All the computation, including the verification of the examples against the regex, runs in your browser. You can paste internal network ranges without exposing them.
Was this tool useful?
Disclaimer We take great care to keep every tool accurate and review it thoroughly; even so, we can't guarantee it is free of errors or take responsibility for how the results are used. We recommend double-checking anything critical.
Found an error? Let us know →