Wildcard Mask Calculator

Last reviewed: May 2026

Enter any subnet mask, CIDR notation, or prefix length below to instantly calculate the wildcard mask. Used for Cisco ACLs, OSPF network statements, firewall rules, and more.

What is a Wildcard Mask?

A wildcard mask is the bitwise inverse of a subnet mask. For each bit position in the 32-bit address:

• Where the subnet mask has a 1-bit (network portion), the wildcard mask has a 0-bit — meaning that bit must match exactly.
• Where the subnet mask has a 0-bit (host portion), the wildcard mask has a 1-bit — meaning that bit is ignored (wildcard).

The calculation is simple: for each octet, subtract the subnet mask octet from 255. For example, subnet mask 255.255.255.0 becomes wildcard mask 0.0.0.255 — every host in the 192.168.1.x network matches when paired with address 192.168.1.0 in a Cisco ACL.

Where Are Wildcard Masks Used?

• Cisco IOS ACLs — access-list 100 permit ip 192.168.1.0 0.0.0.255 — the wildcard tells the ACL which bits to match and which to ignore. A 0 in the wildcard means "must match," a 1 means "ignore."
• OSPF network statements — network 10.0.0.0 0.255.255.255 area 0 — the wildcard identifies which interfaces fall into the OSPF process and area.
• BGP prefix-lists and route-maps — matching route prefixes when filtering or redistributing routes between protocols.
• Firewall rules on Cisco ASA and Palo Alto — defining address ranges for security policies without enumerating individual hosts.

Wildcard Mask Quick Reference Table

Wildcard Mask vs Subnet Mask