What a wildcard mask is
A wildcard mask is commonly used in IPv4 ACL and routing-related configuration to specify which address bits must match and which bits may vary. For a normal contiguous subnet mask, the wildcard is its bitwise inverse. In dotted decimal, that can be calculated as 255 - mask octet for each of the four octets.
For example, 255.255.255.0 corresponds to wildcard 0.0.0.255. A /26 mask of 255.255.255.192 corresponds to 0.0.0.63. The ACL guide explains how these values are used in policy matching.
How to convert mask or CIDR to wildcard
Select the mask-to-wildcard direction and enter either a dotted-decimal subnet mask or a CIDR prefix such as /24. The tool first resolves the prefix to a valid contiguous mask, then inverts every octet. The result shows the subnet mask, prefix and wildcard together.
If you are starting from CIDR and want to understand the mask first, use the mask ↔ CIDR converter. The wildcard tool builds on the same contiguous-mask rules.
How to convert wildcard back to a subnet mask
Select wildcard-to-mask and enter a value such as 0.0.0.255. The tool inverts the value and checks that the resulting subnet mask is contiguous. If the inverted value cannot be represented by one normal CIDR prefix, the converter rejects it instead of reporting a misleading prefix.
This validation matters because not every possible wildcard pattern represents a simple CIDR network. Some platforms allow non-contiguous wildcard matching in specific contexts, but this calculator intentionally focuses on the common subnet-mask relationship.
Understanding wildcard bits in ACL matching
In the traditional ACL interpretation, a wildcard bit of 0 means the corresponding address bit must match, while a wildcard bit of 1 means that bit is ignored for the comparison. A wildcard of 0.0.0.0 therefore matches one exact IPv4 address, while 0.0.0.255 allows the final octet to vary across a /24-sized pattern.
The optional base IP field generates a simple ACL-style expression so you can see the address and wildcard together. Treat it as a study example rather than a complete vendor configuration, because real ACL syntax depends on platform, direction, protocol and policy.
Examples worth recognizing
A /24 has mask 255.255.255.0 and wildcard 0.0.0.255. A /26 has mask 255.255.255.192 and wildcard 0.0.0.63. A /16 has mask 255.255.0.0 and wildcard 0.0.255.255. An exact host /32 corresponds to 255.255.255.255 and wildcard 0.0.0.0.
These patterns become easier to remember when you relate them to block size. The interactive CIDR table and block-size calculator are useful companion references.
Wildcard masks, networks and safety
Do not assume a wildcard is “just another subnet mask.” Its matching semantics are inverted, and a mistake can broaden an ACL unexpectedly. Always verify the network address, intended scope and platform syntax before deploying a rule. If you are translating an arbitrary IP range into policy, first convert the range to exact CIDR prefixes with the range-to-CIDR converter.
For larger rule sets, document the business purpose of each match rather than keeping only the numeric wildcard. That makes later audits and migrations much easier.
Frequently asked questions
Is a wildcard mask always 255.255.255.255 minus the subnet mask?
For the contiguous subnet-mask relationship used by this tool, yes. Each octet is inverted.
What wildcard matches one exact host?
0.0.0.0. Every address bit must match the base IP exactly.
What wildcard corresponds to /24?
/24 is 255.255.255.0, so the wildcard is 0.0.0.255.
Can every wildcard be converted to one CIDR prefix?
No. Only wildcards whose inverse is a valid contiguous subnet mask map cleanly to a single CIDR prefix.
Next step
Use the converter to validate the arithmetic, then check the resulting match against the real network boundaries and ACL intent. Correct syntax is only one part of safe access-control design.