IP in CIDR range checker
Firewall rules, allow-lists and webhook source ranges are written in CIDR. This answers the question you actually have: is this address covered by any of these blocks, and which one.
Free, no signup, no daily limit. We do not store what you check here.
The off-by-one that reaches production
Allow-lists go wrong at the boundaries, and boundaries are where mental arithmetic fails. 192.168.1.128/25 covers .128 to .255, not .128 to .254 or .129 to .255, and a rule written from memory as /24 when it meant /25 grants twice what anybody intended. Checking a specific address against the rule as written costs nothing and catches the class of mistake that is otherwise found by an incident.
Overlapping rules and order
Nothing stops two blocks in a list from overlapping, and this tool reports every block that matches rather than only the first. That is deliberate: in a real firewall the order decides which rule applies, and a list where two entries both match the same address is usually a list somebody edited twice without removing the earlier attempt.
Questions
What format should the input take?
The address first, then the blocks, separated by anything — a comma, the word "in", a newline. The first thing that looks like a bare address is treated as the one being checked.
Does this work for IPv6?
Not yet. The arithmetic here is IPv4 only, and pretending otherwise would give confidently wrong answers on the format where mistakes are hardest to spot.
Related tools
CIDR calculator
Work out the network, broadcast, usable range and host count for any IPv4 CIDR block. Free, instant, no signup.
Datacenter IP checker
Check whether an IP belongs to a hosting provider such as AWS, Google Cloud or Hetzner rather than a home connection. Free.
Bogon and private IP checker
Check whether an address is private, reserved, loopback or documentation-only — the addresses that should never appear as a public source. Free.
When you need more than a free tool
This page answers what can be determined offline and from public DNS. The API adds live carrier and mailbox verification, a calibrated confidence score, and the full evidence trail behind every verdict.
Credits never expire. Inconclusive verdicts are never billed. Cancel in one call. See pricing or read the docs.