Wildcard Mask Converter
Paste whatever you have — a prefix like /26, a subnet mask, or a wildcard — and get all three forms plus the access-list line that uses it.
Interpreted as subnet mask:
access-list 10 permit 192.168.1.0 0.0.0.63
In the NetForge-AI lab you can write this exact access-list on a simulated router and watch the packet animation stop dead at the interface that denies it — the fastest way to internalize how wildcards match.
See the course module on ACLsThe one rule to remember
Wildcard = 255.255.255.255 minus the subnet mask, octet by octet. In the wildcard, 0 means "must match" and 1 means "don't care" — the exact opposite of how you read a subnet mask. So access-list 10 permit 192.168.1.0 0.0.0.63 matches 192.168.1.0–63: the first 26 bits are pinned, the last 6 float.
The same syntax appears in OSPF: network 10.0.0.0 0.0.0.255 area 0 enables OSPF on every interface whose address falls in 10.0.0.0/24. Mixing up mask and wildcard here is one of the most common lab mistakes — the converter above exists so you never have to invert octets in your head mid-config.
Wildcard mask FAQ
What is the difference between a subnet mask and a wildcard mask?
They're bitwise inverses. A subnet mask marks network bits with 1s (255.255.255.0). A wildcard mask marks the bits that may vary with 1s (0.0.0.255). Interfaces are configured with subnet masks; ACLs and OSPF network statements match traffic with wildcards.
How do I convert a subnet mask to a wildcard mask?
Subtract each octet from 255. Mask 255.255.255.192 → wildcard 0.0.0.63. That's identical to flipping every bit, which is why the conversion is instant in both directions.
Why do ACLs use wildcard masks instead of subnet masks?
Wildcards are more general: 0 means 'this bit must match', 1 means 'don't care'. That expresses subnets, but also patterns a subnet mask can't — e.g. 0.0.1.255 can match every odd /24 in a range. Routers evaluate (address XOR pattern) AND NOT wildcard = 0.
What wildcard matches exactly one host, and what matches everything?
0.0.0.0 matches a single address (every bit must match) — routers often display it as the keyword 'host'. 255.255.255.255 matches any address — the keyword 'any'.
More free tools: Subnet Calculator · VLSM Planner