About this tool
Wildcard masks are the inverse of subnet masks and are widely used in Cisco-style ACLs and OSPF network statements. A zero bit means “must match,” while a one bit means “ignore this bit.”
For contiguous masks, converting is straightforward: subtract each subnet-mask octet from 255. The tool accepts either a CIDR prefix or a dotted-decimal subnet mask and returns the corresponding wildcard mask.
How to use it
- Enter a prefix such as 24 or a mask such as 255.255.255.0.
- Calculate the wildcard mask.
- Use the result only after confirming the syntax expected by the target platform and feature.
Example: /26
A /26 uses 255.255.255.192. Inverting each octet gives the wildcard mask 0.0.0.63.
Engineering notes
- Wildcard masks are not the same as subnet masks even though they describe related bit positions.
- Some ACL designs use non-contiguous wildcard masks. This calculator focuses on the common contiguous subnet-mask conversion case.
Frequently asked questions
What is the wildcard mask for /24?
0.0.0.255.
Why does 255 become 0?
A subnet-mask bit set to 1 identifies a required network bit; the corresponding wildcard bit is 0, meaning it must match.
Do Juniper firewall filters use Cisco wildcard masks?
Typically no. Junos generally expresses address matches with prefixes rather than IOS-style wildcard masks.