CIDR aggregator & splitter

Aggregation

Two blocks can be merged into one when they are the same size, adjacent, and the combined block is aligned to its new size: 10.0.0.0/25 and 10.0.0.128/25 become 10.0.0.0/24, but 10.0.0.128/25 and 10.0.1.0/25 do not. The tool sorts the input, merges everything that overlaps or touches, and then writes each resulting span as the fewest aligned blocks. This is what routers do when they summarise routes, and what you want before pasting a list into a firewall: fewer rules, faster matching, no duplicates.

Ranges to CIDR

An arbitrary range such as 192.168.1.6 – 192.168.1.9 is rarely one block. The algorithm takes the largest aligned block that starts at the range's first address and fits inside it, then repeats from where that block ends: here 192.168.1.6/31 and 192.168.1.8/31. A range of 255 addresses starting at .1 needs eight blocks.

Exclusions

“Everything in 10.0.0.0/8 except 10.1.0.0/16” is a common need for split tunnels and allow-lists. Subtracting a /16 from a /8 leaves 8 blocks (/9, /10 … /16), because each step of the binary split peels off one half. The output grows by about one block per bit of difference.

Output formats

The nftables form produces a set you can paste into nft add element; iptables emits one rule per block; the Cisco form uses wildcard masks; the HAProxy form is a file for acl src -f. The ranges form is useful for documentation and for systems that take start–end pairs.

Questions