{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }} {{ badge.label }} {{ badge.value }}
Auto detect reports the resolved parser in the summary and source ledger.
Use CSV metadata to produce an owner-aware remediation queue; plain CIDR lines remain supported.
{{ sourceMeta }}
{{ sourceStatus || 'Drop one CSV or text file onto the editor.' }}
Separate ports or services with commas, spaces, or semicolons.
Choose the boundary that will actually consume this allowlist.
Use strict mode when source normalization must happen upstream.
The default /16 is a policy threshold, not an internet standard.
/
The default /48 flags organization-scale ranges while preserving the prefix value in evidence.
/
Use the evidence cutoff date for this review, not the browser clock.
Set 0 to flag only rows that expire on the review date or earlier.
days
{{ workflowFeedback }}
Leave blank for the neutral label “CIDR allowlist review.”
PriorityCIDRFindingEvidenceNext actionCopy
{{ row.severity }}{{ row.cidr }}{{ row.finding }}{{ row.evidence }}{{ row.action }}
LabelCIDRScopePortsOwnerReview dateRiskDecisionCopy
{{ row.label }}{{ row.cidr }}{{ row.scope }}{{ row.ports }}{{ row.owner }}{{ row.expires }}{{ row.risk }}{{ row.decision }}
RelationshipCIDR ACIDR BShared addressesNext actionCopy
{{ row.relationship }}{{ row.cidr_a }}{{ row.cidr_b }}{{ row.shared_addresses }}{{ row.action }}
iptables Rule Generator Build bounded iptables or ip6tables commands for a packet path with explicit CIDR and port matches, persistence choices, and production-safety checks.
BGP Prefix List Generator Turn IPv4 and IPv6 CIDR rows into platform-specific prefix-list syntax, with normalized networks and ordered-policy warnings.
IP Overlap Checker Check IPv4 CIDRs and ranges for exact duplicates, containment, partial overlap, host-bit corrections, and duplicate address coverage.
ACL Wildcard Mask Calculator Calculate IPv4 ACL wildcard masks from CIDR and dotted entries, then audit generated lines for address coverage and dangerous overlaps.

An IP allowlist turns a network address into permission. Firewalls, gateways, applications, and managed services use that permission to admit traffic from a partner, office, virtual private network, monitoring service, or emergency administrator while rejecting other sources. The exception is useful only while the range is accurate, narrow enough for its purpose, and tied to someone who can review or remove it.

Classless Inter-Domain Routing (CIDR) notation writes a network as an address and slash prefix. The prefix fixes the leading address bits. A longer prefix leaves fewer possible source addresses, so an IPv4 /32 identifies one address and a /24 contains 256. At the other extreme, 0.0.0.0/0 and ::/0 match every address in their respective families.

Network boundary
The first address represented by a prefix. A CIDR written with host bits set may still identify the same range, but the non-canonical form is easier to misread.
Special-purpose range
Address space reserved for private networks, documentation, loopback, link-local, multicast, benchmarking, or another defined purpose rather than ordinary public routing.
Exposure context
The boundary that consumes the allowlist, such as internet ingress, administrative access, a partner API, or an internal policy.
Review date
An explicit evidence cutoff used to decide whether an exception is expired or approaching review.

Breadth alone does not settle risk. A partner HTTPS range and an administrative SSH range can contain the same number of addresses but create very different exposure. Ports, public or private scope, ownership, expiry, overlap, and the source of provider-maintained ranges all affect the decision.

  • Broad public ranges increase the number of systems that may attempt a connection.
  • Administrative, database, directory, file-sharing, cache, and remote-control services deserve tighter source restrictions.
  • Duplicate, parent, and child ranges make removal harder because another rule may preserve the same access.
  • Private or documentation addresses on an external boundary often reveal NAT confusion, placeholder data, or a copied example.

Source IP is not identity. An allowlist can reduce unsolicited exposure, but it does not replace authentication, authorization, patching, logging, or destination hardening. Proxies, load balancers, and virtual private networks can also change the address seen by the enforcement point, so the deployed path must be tested from both allowed and denied sources.

How to Use This Tool:

Review the same source list, service scope, and cutoff date that will support the approval decision.

  1. Choose Input format, then paste one CIDR per line or CSV rows with a range and any available label, ports, owner, expiry, and note. Auto detect reports whether it resolved the source as CIDR lines or CSV.
  2. Enter Default ports for rows that do not carry their own service list, and set Exposure context to the boundary that will use the rule.
  3. Select Host-bit handling. Normalization converts an address to its network boundary and records the correction; strict handling rejects non-canonical CIDRs until the source is fixed.
  4. Set the IPv4 and IPv6 broad-range thresholds, Review date, and Expiry warning window. The defaults are /16, /48, and 30 days; these are review-policy choices, not internet standards.
  5. Read Risk triage first, then use Exposure ledger and Coverage review to verify the exact range, service, owner, date, and overlap behind each priority.

Interpreting Results:

Highest review priority is the largest row score in the current list. It is deliberately conservative: several minor findings do not add together, and one severe row is not diluted by safer rows. Start with the evidence and next action on that row rather than treating the number as an industry security rating.

  • Critical or High calls for source or port reduction, expiry repair, or documented exception evidence before approval.
  • Medium points to evidence that still changes the decision, such as a scope mismatch, approaching expiry, missing review date, broad non-public range, or several overlaps.
  • Low identifies cleanup such as one overlap, a missing owner, an implicit host prefix, or host-bit normalization.
  • Clear means no configured heuristic fired. It does not prove business need, authentication strength, provider freshness, or the deployed firewall state.

Technical Details:

A CIDR range is obtained by masking the entered address to its prefix and retaining every value from that network boundary through the last host value. IPv4 uses 32 bits and IPv6 uses 128. Overlap is possible only within the same address family.

Formula Core:

The number of addresses depends only on the address-family width and the prefix length.

A = 2B-P

A is the address count, B is 32 for IPv4 or 128 for IPv6, and P is the prefix. Thus 198.51.100.64/27 contains 2^(32 - 27), or 32 addresses. Counts longer than 15 digits are displayed in shortened scientific notation.

Rule Core:

Each row keeps the largest applicable finding score. The overall score is the largest row score, and the band boundaries are exact.

SignalConditionScore
Internet-wide sourceThe prefix is exactly /0.100
Sensitive service exposureSensitive ports appear with administrative context, /0, or all ports on a public-like range.90
Broad public sensitive sourceA broad public-like range includes a sensitive service.76
Expired reviewThe expiry is before the selected review date.75
Broad public rangeThe prefix is at or below the chosen threshold and the range is public-like.72
Service evidenceA narrower row still includes a recognized sensitive service.48
Provider freshnessProvider-like wording appears on a broad range.46
Approaching expiryThe expiry is on or before the review date plus the warning window.45
Scope mismatchA non-internal context contains private, special-purpose, or documentation space.44
Broad non-public rangeThe prefix is at or below the threshold within non-public space.42
Overlap or evidence gapsMultiple overlaps score 40, a missing review date scores 36, one overlap scores 28, and a missing owner scores 24.24 to 40
Canonical-form cleanupAn invalid date scores 18, normalized host bits score 16, and an address without a slash converted to /32 or /128 scores 12.12 to 18
BandExact boundaryPrimary decision
CriticalScore >= 85Block approval pending reduction or explicit exception review.
High65 <= score < 85Reduce the range or repair stale evidence.
Medium35 <= score < 65Review the named evidence before approval.
Low0 < score < 35Clean up the source record.
ClearScore = 0No heuristic finding; continue normal security review.

Ports may be numbers, ranges, all-port tokens, or recognized service names. Expiry is calculated from the explicit Review date, making saved reviews reproducible. Pairwise range comparison labels duplicates, containment, and partial overlaps and reports the shared address count.

The source is limited to 512 KiB and 700 non-blank rows. IPv4 and IPv6 parsing, canonicalization, scoring, and overlap checks are deterministic. No live route, firewall, service, ticket, or provider lookup forms part of the result.

Limitations and Privacy Notes:

The review analyzes pasted text and loaded files in the browser. It cannot confirm which address a proxy presents, whether the rule is deployed, whether a provider list is current, or whether the destination has adequate authentication.

  • Do not share copied rows or reports containing private ranges, owners, tickets, or infrastructure notes outside their approved audience.
  • Test the actual enforcement point from expected allowed and denied sources before relying on a change.
  • Confirm provider-managed ranges from the provider’s maintained source instead of accepting a label or note as freshness proof.

Worked Examples:

Expired administrative access:

A CSV row containing 0.0.0.0/0, SSH, RDP, and an expiry before the review date receives an internet-wide score of 100 and sensitive-service score of 90. The row remains Critical because the row score is the maximum finding, not the sum. Replace the range with a named virtual private network or jump-host source and renew only the access still required.

Host inside a parent range:

198.51.100.70/27 normalizes to 198.51.100.64/27. If 198.51.100.70/32 also appears, coverage review reports that the parent contains the host. Strict host-bit handling rejects the first value instead of rewriting it, which is useful when canonicalization must happen in the source inventory.

References: