Firewall Address Exclusion Calculator
Subtract exceptions from allowed ranges.
Firewall Address Exclusion Calculator: inputs and results
Enter an IP address, CIDR prefix, or range. Then check its first and last address below.
Calculated Boundaries & ParametersReady
Key Capabilities
- •100% Client-Side: Zero telemetry or server latency.
- •RFC Compliant: Exact 32-bit and 128-bit integer precision.
- •Quick Copy: Instant access to CIDR, mask, and range bounds.
- •Cross-Platform: Works on desktop, tablet, and mobile browsers.
Related Planning, VLSM & CloudAll Tools
VLSM Calculator
Allocate differently sized subnets.
VLSM Allocation Validator
Check alignment, capacity, and overlaps.
Supernet Calculator
Find a covering parent prefix.
Exact CIDR Aggregator
Merge prefixes without adding addresses.
Route Summary Calculator
Summarize networks and identify included gaps.
DHCP Scope Calculator
Plan allocation boundaries within a subnet.
How Firewall Address Exclusion Calculator Works?
This tool works by subtracting every exception from the allowed ranges and returning the remaining space as exact CIDR blocks, for firewalls that support permit rules only.
Enter the allowed ranges
Type the broad scope, such as
10.0.0.0/8.Enter the exceptions
Type the addresses to exclude, such as
10.10.0.0/16and10.200.5.0/24.Subtract
The calculator removes each exception from the allowed ranges.
Output the CIDR list
The remaining space appears as the minimal list of CIDR blocks, ready to paste into a permit rule.
Firewall Address Exclusion Calculator Formula
The formula is Permit List = CIDR(Allowed − ∪ Exceptions).
Remaining space
Allowed − ∪ ExceptionsSet difference.
Block count
up to 32 − p blocks per exceptionRemoving a /32 from a /8 leaves 24 blocks.
Size
|Allowed| − |Exceptions ∩ Allowed|Permitted addresses.
Worked example: 10.0.0.0/8 minus 2 exceptions
Allowed : 10.0.0.0/8 (16,777,216) Exceptions : 10.10.0.0/16, 10.200.5.0/24 Permit list: 22 CIDR blocks Permitted : 16,711,424 addresses
Firewall Address Exclusion Calculator Conversion Table
The table lists the permit blocks for 10.0.0.0/8 with 10.10.0.0/16 and 10.200.5.0/24 excluded.
| # | Permit Block | Addresses |
|---|---|---|
| 1 | 10.0.0.0/13 | 524,288 |
| 2 | 10.8.0.0/15 | 131,072 |
| 3 | 10.11.0.0/16 | 65,536 |
| 4 | 10.12.0.0/14 | 262,144 |
| 5 | 10.16.0.0/12 | 1,048,576 |
| 6 | 10.32.0.0/11 | 2,097,152 |
| 7 | 10.64.0.0/10 | 4,194,304 |
| 8 | 10.128.0.0/10 | 4,194,304 |
| 9 | 10.192.0.0/13 | 524,288 |
| 10 | 10.200.0.0/22 | 1,024 |
| 11 | 10.200.4.0/24 | 256 |
| 12 | 10.200.6.0/23 | 512 |
| 13 | 10.200.8.0/21 | 2,048 |
| 14 | 10.200.16.0/20 | 4,096 |
| 15 | 10.200.32.0/19 | 8,192 |
| 16 | 10.200.64.0/18 | 16,384 |
| 17 | 10.200.128.0/17 | 32,768 |
| 18 | 10.201.0.0/16 | 65,536 |
| 19 | 10.202.0.0/15 | 131,072 |
| 20 | 10.204.0.0/14 | 262,144 |
| 21 | 10.208.0.0/12 | 1,048,576 |
| 22 | 10.224.0.0/11 | 2,097,152 |
What is Firewall Address Exclusion Calculator?
The Firewall Address Exclusion Calculator is a tool that turns "allow this range except these addresses" into an exact list of CIDR blocks.
Many platforms have no "except" keyword: AWS security groups, Azure NSG service rules, Kubernetes NetworkPolicy ipBlock fields without except, and simple router ACLs. The only way to express an exception is to permit everything around it.
The block count grows with the depth of each exception. Excluding a /24 from a /8 needs 16 blocks, and excluding a /16 needs 8 blocks.
What are the uses of Firewall Address Exclusion Calculator?
There are 4 main uses of the Firewall Address Exclusion Calculator, including security groups, VPN split tunnels, and egress policies.
Writing cloud security group rules
Security groups accept permit rules only, so exclusions become permit lists.
Building VPN split-tunnel lists
VPN clients route 0.0.0.0/0 minus local networks through the tunnel.
Defining egress policies
Egress rules allow the internet minus RFC 1918 space.
Isolating sensitive subnets
A broad internal permit excludes the payment or management subnet.