IP range exclusion tool
Remove forbidden addresses, subnets or ranges from your allowed networks and get the exact remainder as the smallest CIDR list. Works with IPv4 and IPv6.
Up to 100,000 characters and 1,000 entries in each box, with at most 2,048 resulting CIDR blocks. Everything is calculated on your device and nothing is uploaded. Downloads: a plain text CIDR list, a CSV of blocks with first address, last address and address count, and a JSON report. One allowed address, CIDR block or range per line. Put the networks to remove in the second box. Up to 100,000 characters. Review the settings before running.
Your result
How to use IP range exclusion tool
- Paste the allowed networks in the main box.
- Paste the networks to exclude in the second box.
- Run the exclusion and review the remaining CIDR blocks.
- Copy the list or download the text list, CSV or JSON report.
Useful next steps
How the subtraction works
Allowed entries are joined into one exact address set, every excluded address is removed, and what remains is written as the fewest aligned CIDR blocks, following RFC 4632 (2006) for CIDR and RFC 5952 (2010) for IPv6 text. A self-check confirms the blocks cover exactly the remaining addresses, so an excluded address cannot slip back in.
What you can paste
Use one entry per line, or separate entries with commas, semicolons or spaces. An entry can be an address such as 192.0.2.10, a CIDR block such as 192.0.2.0/24 or an inclusive range such as 192.0.2.10-192.0.2.20, and spaces around the hyphen are fine. Text after # is ignored, so you can keep comments. IPv4 parts must be 0 to 255 without leading zeros, because some systems read 010 as octal. Interface zones such as %eth0 and netmasks such as 255.255.255.0 are not accepted. Both boxes use the same format, and the exclusion box may be empty.
Spotting mistakes
The JSON report marks each allowed entry as kept, reduced or removed, and each exclusion as applied or no-overlap. An exclusion with no overlap often points to a typo or the wrong address family. If every allowed address is excluded, the result says so and the list is empty.
Host bits and address families
An entry such as 192.0.2.10/24 has bits set after its prefix length. It is rejected by default, because it may be a typo for a single address. Choose Use the network address to treat it as 192.0.2.0/24; the JSON report lists every entry changed this way. IPv4 and IPv6 are handled separately, and IPv4-mapped IPv6 addresses such as ::ffff:192.0.2.1 stay in IPv6.