ACL Wildcard Mask Calculator
Use this ACL wildcard mask calculator to convert a subnet mask or CIDR prefix into the inverse mask commonly used in access control lists.
Updated May 2026No signup requiredMobile friendly
Calculator
Enter your values, then choose Calculate.
How to use this calculator
Enter the planning values that match your network, storage, or cloud scenario. Use realistic production assumptions when sizing anything that affects availability, performance, or cost.
Formula or calculation method
A wildcard mask is the inverse of a subnet mask. Each subnet-mask bit is flipped so 255.255.255.0 becomes 0.0.0.255.
Worked example
A /24 subnet mask is 255.255.255.0, so the ACL wildcard mask is 0.0.0.255.
Practical planning tips
- Router ACL planning.
- Firewall rule documentation.
- Network certification study checks.
Common mistakes to avoid
- Using a subnet mask where a wildcard mask is required.
- Forgetting that wildcard masks are inverse masks.
- Mixing CIDR prefixes and dotted masks without converting.
FAQ
Frequently asked questions
Is 0.0.0.0 a valid wildcard?
Yes. It matches one exact host when paired with a host address.
What is the wildcard for /32?
A /32 mask is 255.255.255.255, so the wildcard is 0.0.0.0.
Related guides
Subnetting Basics GuideReview IPv4 subnet terms and address ranges.CIDR Notation GuideUnderstand slash notation and subnet masks.MB vs Mbps GuideAvoid confusing file size and network speed units.Backup Retention Planning GuidePlan backup retention and storage growth.RAID Is Not Backup GuideUnderstand where RAID helps and where backups are still required.