# IP range exclusion tool - Human page: https://happytails.ai/en/network-tools/ip-range-exclusion-tool/ - Markdown: https://happytails.ai/en/network-tools/ip-range-exclusion-tool.md - Structured JSON: https://happytails.ai/agents/en/network-tools/ip-range-exclusion-tool/index.json - Visibility: public ## Tool capabilities | Property | Value | | --- | --- | | Tool ID | `ip-range-exclusion-tool` | | Category | network-tools | | Implementation | Registered implementation. Registration alone is not a production-quality guarantee. | | Browser execution | Use the visible action or interactive controls. | | Browser processing | Browser; see tool notes for network behavior. | | HTTP API | Not callable through HTTP. | | Browser-agent interface | run_current_tool | ### Implementation notes Subtraction runs on your device for up to 100,000 characters and 1,000 entries in each box, with at most 2,048 resulting CIDR blocks. ### Inputs and settings Text input: Allowed networks. Example or placeholder shown in the interface (not a validated fixture): ```text 10.0.0.0/16 2001:db8:abcd::/48 ``` One allowed address, CIDR block or range per line. Put the networks to remove in the second box. Up to 100,000 characters. Review the settings before running. | Setting | Meaning | Control type | Default | Constraints | | --- | --- | --- | --- | --- | | `exclude` | Networks to exclude | textarea | "" | | | `hostBits` | Host bits in CIDR entries | select | "reject" | Allowed: reject, normalize | ### Browser-agent workflow 1. Open the human page in a browser that supports WebMCP. 2. Discover the interface exposed by that page; use its actual schema. 3. Select files on the page first when the tool requires files. 4. Call `run_current_tool` with valid input and settings. 5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links. Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution. ### Planning specification Up to 100,000 characters and 1,000 entries in each box, with at most 2,048 resulting CIDR blocks. Everything is calculated on your device and nothing is uploaded. Downloads: a plain text CIDR list, a CSV of blocks with first address, last address and address count, and a JSON report. This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support. ### Complete machine-readable capability record ```json { "id": "ip-range-exclusion-tool", "category": "network-tools", "built": true, "requirements": "Up to 100,000 characters and 1,000 entries in each box, with at most 2,048 resulting CIDR blocks. Everything is calculated on your device and nothing is uploaded. Downloads: a plain text CIDR list, a CSV of blocks with first address, last address and address count, and a JSON report.", "implementation": { "fields": [ { "key": "exclude", "label": "Networks to exclude", "value": "", "type": "textarea", "help": "One address, CIDR block or start-end range per line. These addresses are removed from the allowed networks." }, { "key": "hostBits", "label": "Host bits in CIDR entries", "value": "reject", "type": "select", "values": [ "reject", "normalize" ], "labels": { "reject": "Reject the entry", "normalize": "Use the network address" }, "help": "An entry such as 192.0.2.10/24 has host bits set. Rejecting it is safest; normalizing uses 192.0.2.0/24 and lists the change in the report." } ], "registrationFamily": "ip-prefix-sets", "inputMaxLength": 100000, "inputErrorCode": "IP_PREFIX_SETS_TOO_LONG", "note": "Subtraction runs on your device for up to 100,000 characters and 1,000 entries in each box, with at most 2,048 resulting CIDR blocks.", "experience": { "automatic": false, "single": false, "inputMaxLength": 100000, "inputMode": "text", "label": "Allowed networks", "placeholder": "10.0.0.0/16\n2001:db8:abcd::/48", "help": "One allowed address, CIDR block or range per line. Put the networks to remove in the second box. Up to 100,000 characters. Review the settings before running.", "action": null }, "mode": "explicit", "interactive": false }, "execution": "Browser interface", "api": null, "browser_agent": { "supported": true, "name": "run_current_tool", "discovery": "WebMCP on the human page in a supporting browser", "verification": "See audit/API-AUDIT.md; availability is not verification" } } ``` ## Page guide Remove forbidden addresses, subnets or ranges from your allowed networks and get the exact remainder as the smallest CIDR list. Works with IPv4 and IPv6. How can we improve this tool? Report a problem or share an idea. Please leave out private information. Your message and the tool name go to our team via PostHog. ### How to use IP range exclusion tool 1. Paste the allowed networks in the main box. 2. Paste the networks to exclude in the second box. 3. Run the exclusion and review the remaining CIDR blocks. 4. Copy the list or download the text list, CSV or JSON report. ## Useful next steps - [IP allowlist merger](https://happytails.ai/en/network-tools/ip-allowlist-merger/) ([Markdown](https://happytails.ai/en/network-tools/ip-allowlist-merger.md)) - [IP allowlist overlap checker](https://happytails.ai/en/developer-tools/ip-allowlist-overlap-checker/) ([Markdown](https://happytails.ai/en/developer-tools/ip-allowlist-overlap-checker.md)) - [CIDR to range](https://happytails.ai/en/network-tools/cidr-to-range/) ([Markdown](https://happytails.ai/en/network-tools/cidr-to-range.md)) - [Subnet calculator](https://happytails.ai/en/network-tools/subnet-calculator/) ([Markdown](https://happytails.ai/en/network-tools/subnet-calculator.md)) ## How the subtraction works Allowed entries are joined into one exact address set, every excluded address is removed, and what remains is written as the fewest aligned CIDR blocks, following RFC 4632 (2006) for CIDR and RFC 5952 (2010) for IPv6 text. A self-check confirms the blocks cover exactly the remaining addresses, so an excluded address cannot slip back in. ### What you can paste Use one entry per line, or separate entries with commas, semicolons or spaces. An entry can be an address such as 192.0.2.10, a CIDR block such as 192.0.2.0/24 or an inclusive range such as 192.0.2.10-192.0.2.20, and spaces around the hyphen are fine. Text after # is ignored, so you can keep comments. IPv4 parts must be 0 to 255 without leading zeros, because some systems read 010 as octal. Interface zones such as %eth0 and netmasks such as 255.255.255.0 are not accepted. Both boxes use the same format, and the exclusion box may be empty. ### Spotting mistakes The JSON report marks each allowed entry as kept, reduced or removed, and each exclusion as applied or no-overlap. An exclusion with no overlap often points to a typo or the wrong address family. If every allowed address is excluded, the result says so and the list is empty. ### Host bits and address families An entry such as 192.0.2.10/24 has bits set after its prefix length. It is rejected by default, because it may be a typo for a single address. Choose Use the network address to treat it as 192.0.2.0/24; the JSON report lists every entry changed this way. IPv4 and IPv6 are handled separately, and IPv4-mapped IPv6 addresses such as ::ffff:192.0.2.1 stay in IPv6.