Bulk-checking IPs against firewall and ACL CIDR allow lists

Published: 2026-09-05

How CIDR membership works for allow and deny lists, why host bits must be zero, and how to bulk-test IPv4 or IPv6 addresses against firewall rules offline.

When you review a VPN cutover, a cloud security-group change, or a “is this host still inside our office ranges?” ticket, the question is rarely “what is the mask of this one /24?” It is which of these IPs fall inside which CIDR blocks. Pasting each address into a single-subnet calculator does not scale. Membership checking compares a list of addresses against a list of prefixes and reports in, out, or invalid for each line.

This guide covers how that test works, how allow vs deny lists change interpretation, why CIDR rows must use network addresses, and how to run the workflow locally so inventory and firewall dumps never leave the device. For prefix length and mask basics, start with Subnet math and CIDR explained. To shrink overlapping CIDR exports before you test, see Summarizing firewall CIDR lists with route aggregation.

What “in a CIDR” means

A CIDR like 192.168.0.0/16 is a closed interval of addresses: from the network address through the last address in the block. An IP is in that block when its numeric value sits between those endpoints (inclusive).

Address	Against `10.0.0.0/24`	Result
`10.0.0.1`	Inside the range	In
`10.0.0.255`	Last address in the `/24`	In
`10.0.1.1`	Next subnet	Out
`10.0.0.0`	Network address itself	In

/32 (IPv4) or /128 (IPv6) means “exactly this one address.” Overlapping CIDRs are normal in real ACLs: an IP can match several blocks; a good checker lists all matches, not only the first.

IPv6 uses the same interval idea with 128-bit addresses and prefixes 0–128. Keep IPv4 and IPv6 lists in separate passes—mixed paste is not one address space.

Allow lists vs deny lists (same math, different story)

The membership algorithm does not know your policy intent. It only answers: does this IP fall inside at least one of these prefixes?

List type	“In” usually means	How to read “Out”
Allow / permit	Traffic from this IP is covered by a permit rule	Candidate for block, or missing from the intended cover
Deny / drop	This IP is covered by an explicit deny	Not hit by that deny (other rules may still apply)
VPN / route table	Destined for a advertised prefix	Needs a different path or default

Do not treat a bulk “Out” column as “safe to expose on the internet.” It only means “not in this pasted list.” Real firewalls evaluate ordered rules, shadows, and default actions you are not simulating here.

Inputs that break checks

Membership tools should be strict about CIDR form. A route or ACL line names a network, not a host with a prefix slapped on.

Paste	Typical status	Why
`192.168.1.0/24`	Valid CIDR	Host bits clear
`192.168.1.10/24`	Reject	Host bits set; network form is `.0/24`
`192.168.1.10` as a CIDR	Reject	Missing `/prefix`
`not-an-ip` as an IP	Invalid IP	Not a parseable address
`# office VLAN`	Skip	Comment line

Blank lines and # comments are common in exports; parsers should ignore them. Invalid IP lines stay in the result table as invalid so you can fix typos without losing row order from a log paste.

Worked bulk example

Suppose your allow list is:

# RFC1918 office + lab
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

And you paste candidate IPs:

10.1.2.3
192.168.50.10
8.8.8.8
172.20.0.5
203.0.113.9

Expected membership:

IP	Status	Matched CIDR(s)
`10.1.2.3`	In	`10.0.0.0/8`
`192.168.50.10`	In	`192.168.0.0/16`
`8.8.8.8`	Out	—
`172.20.0.5`	In	`172.16.0.0/12`
`203.0.113.9`	Out	—

If you later add 10.0.0.0/16 as well, 10.1.2.3 still matches 10.0.0.0/8 only; 10.0.5.1 would list both overlapping covers. That double-match is useful when auditing redundant rules.

Where this sits next to other network tools

Tool job	Question it answers
Subnet Calculator	For one prefix: mask, network, broadcast, usable hosts
CIDR Aggregator	For many prefixes: merge overlap/adjacency into a minimal list
IP in CIDR checker	For IPs vs a list: which addresses fall inside which blocks

A practical review loop: aggregate a messy export → membership-check inventory IPs against the cleaned list → Diff Checker for before/after rule files in the PR. Aggregation changes representation, not policy; membership confirms coverage for the hosts you care about.

Why run this in the browser

IP inventories and firewall CIDR dumps often include customer sites, VPC IDs, and internal hostnames. Pasting them into a public “IP lookup” site uploads that topology. A browser-only checker parses and compares in your tab—no upload—so the lists never leave the device. See Why “local only” matters for developer tools.

Try it locally

The IP in CIDR checker takes one IP per line on the left and one CIDR per line on the right (IPv4 or IPv6 mode), skips # comments, rejects non-network CIDR forms, marks each address in/out/invalid with all matched blocks, and copies a tab-separated table for tickets—entirely offline.

Related LocalTools: CIDR Aggregator to collapse the allow list first, Subnet Calculator for single-prefix design, and Diff Checker to compare rule files after you trim false “Out” rows caused by typos.