IP in CIDR: check an address against one or more ranges
AdminKit's IP-in-CIDR tool checks whether a pasted IPv4 or IPv6 address falls inside one or more CIDR ranges you list — the allowlist or firewall-rule question network admins ask daily — reporting each range's normalized network and well-known category, computed entirely in your browser with nothing sent to a server.
Part of the IP & network cluster — more tools, guides and terms on ip & network.
What the result means
"Contained" means the address falls inside that normalized network — the same test a firewall or router performs against its allow/deny list. A CIDR of a different IP version than the address always reports "not contained," never an error, matching how a real router compares them. A special-use label (RFC 1918 private, loopback, link-local...) only appears when the whole range sits inside that one category; a range spanning more than one is reported as "mixed" rather than mislabeled.
Next step
Need the network/broadcast/host-range math for one of those CIDRs instead of a membership test? Use the subnet calculator, or classify a single address's own special-use category with IP info next.
Keep this result
Copy a link to this check so you can share it or run it again later. Want a heads-up if something changes? That's early access, not a live feature yet — tell us and we'll set it up by hand.
How it works and limits
Paste a single IPv4 or IPv6 address, then list one or more CIDR ranges — one per line or comma-separated — and this tool reports, for each range, whether the address is contained, the range’s normalized network (host bits past the prefix are zeroed, matching RFC 4632’s classless addressing), and, when the whole range sits inside one well-known special-use category, that category’s name. Nothing is looked up over the network: every comparison is bitwise arithmetic on the numbers you paste, run in your browser.
What it checks
- Membership, per range — whether the address’s numeric value, masked to the range’s prefix length, equals the range’s own network address — the exact test a router or firewall performs against a route table or access-control list entry.
- Version matching — an IPv4 address can only ever be contained in an IPv4 range, and an IPv6 address only in an IPv6 range; a version mismatch is reported as an honest “not contained,” never an error, so a mixed list of IPv4 and IPv6 ranges (common in a real firewall policy) can be checked in one pass.
- Normalized network — the range as actually tested, with every bit after the prefix length zeroed, so
10.0.0.5/24is shown and tested as10.0.0.0/24rather than silently assumed to be what you meant. - Well-known category, when unambiguous — if a range sits entirely inside a recognized special-use block (private use under RFC 1918, loopback, link-local, CGNAT, documentation, benchmarking, multicast, reserved, or for IPv6 also ULA, the NAT64 prefix and the discard-only block), that category is named. A range spanning more than one category is reported as mixed rather than mislabeled.
Reading the result
“Contained” answers one specific question: does this address’s numeric value fall inside this range as defined? It says nothing about whether the address is reachable, currently assigned to a device, or routed anywhere — only that the arithmetic matches. Checking an address against several ranges at once is the real “does this IP match one of my firewall/allowlist entries?” workflow: paste the ranges from your rule set and the address you want to test, and scan down the list for which ones say contained.
Limits
- This is address arithmetic only — it does not query a live firewall, route table or ACL, and it cannot tell you whether a range is actually enforced anywhere.
- The special-use category label covers the ranges most allowlist reviews actually ask about (listed above), not every narrow carve-out in either IANA special-purpose registry.
- For a single address’s own special-use classification and reverse-DNS form, see IP info or IPv6 info instead; for one CIDR’s network/broadcast/host-range math, see the subnet calculator.
See subnet and RFC 1918 private address for background on CIDR notation and the most common private range this tool checks against.
Frequently asked questions
Does this tool send my address or ranges anywhere?
No — the membership test runs entirely in your browser's JavaScript. Nothing you type is sent to a server, logged or stored, the same offline pattern as AdminKit's subnet calculator and IP info tools.
I pasted an IPv4 address and an IPv6 range (or vice-versa) — why does it just say "not contained" instead of erroring?
A CIDR range only ever contains addresses of its own IP version, so comparing across versions is a well-defined "no" rather than invalid input — the same way a router's routing table or a firewall's rule set would treat it. This matches the behavior of Python's own ipaddress library, which the live /v1/tools/ip-in-cidr API this page's logic was verified against also relies on.
What does a range labeled "spans more than one address category" mean?
It means the CIDR you entered is wide enough to straddle a boundary between two or more of the well-known special-use ranges this tool checks — the broadest example is 0.0.0.0/0 or ::/0, which contains everything from loopback to global unicast. Rather than force-fit a wide range into one category it only partly matches, the tool reports it honestly as mixed.
Why does 10.0.0.5/24 normalize to 10.0.0.0/24 instead of staying as I typed it?
A CIDR's network address is defined by zeroing every bit after the prefix length, regardless of what you typed in the host portion — the same "non-strict" normalization Python's ipaddress.ip_network(..., strict=False) performs. This tool shows the normalized network so you can see exactly what range is actually being tested, not just echo your input back.
Does this cover every IANA special-purpose range when labeling a CIDR?
No — like AdminKit's IP info tool, it covers the ranges most allowlist/firewall reviews actually ask about (private use, loopback, link-local, CGNAT, documentation, benchmarking, multicast, reserved, and for IPv6 also ULA, NAT64 and the discard-only block), not every narrow carve-out in either IANA registry.