Whitelist corporate IP ranges with CIDR blocks

Quick answer

When you need to allow (or block) a whole range of addresses — an office, a partner’s network, a cloud region — you don’t list every IP. You use CIDR notation to express the range in one compact rule. Here’s how to read, build, and apply CIDR ranges for allow-lists and firewalls.

Reading CIDR notation

A CIDR block looks like 203.0.113.0/24. The number after the slash is the prefix length — how many leading bits are fixed as the network portion. The rest are free for hosts. A /24 fixes 24 bits, leaving 8 for hosts: 256 addresses (203.0.113.0–255). A /32 fixes all 32 bits — a single IP. The smaller the number, the larger the range.

Common block sizes

Quick reference: /32 = 1 address, /30 = 4, /29 = 8, /28 = 16, /24 = 256, /16 = 65,536. So allow-listing an office on a /29 covers its 8 addresses in one rule; a partner’s whole /24 covers 256. For the maths behind these, our CIDR calculator and subnet mask calculator work out ranges and host counts for any prefix.

Building an allow-list from a set of IPs

If you have a scattered list of addresses to allow, first identify the network they belong to — our Bulk IP Audit tool shows each IP’s ASN and the provider behind it. Contiguous addresses from one source can often be collapsed into a single CIDR block. Where they can’t, list the individual /32s. The goal is the fewest rules that cover exactly what you intend — no more.

Applying it safely

Add the CIDR blocks to your firewall, web server config, or CDN access rules as allow (or deny) entries. The critical discipline: keep the ranges tight. An over-broad allow-list (say a whole /16 when you meant a /29) grants access to thousands of addresses you never intended — a common and serious misconfiguration. Always confirm the block size matches your intent before applying.

For blocking, the same logic inverts

The same CIDR rules block ranges instead of allowing them — useful for shutting out an abusive network in one entry rather than per-IP (see blocking abusive ASN networks). Whether allowing or denying, CIDR is how you operate on ranges instead of single addresses.