Least privilege · 3 min read

Subnet mask vs wildcard mask: stop mixing them up

A wildcard mask is not a subnet mask, and using one where the other belongs quietly matches the wrong addresses. The good news: they are exact inverses, so once the relationship clicks you never have to guess again.

They are inverses of each other

A subnet mask marks the network bits with 1s: /24 is 255.255.255.0. A wildcard mask marks the bits to ignore with 1s — it is the bitwise inverse of the subnet mask. So /24 becomes wildcard 0.0.0.255. A 1 in a wildcard means "this bit can be anything"; a 0 means "this bit must match."

Where each one belongs

access-list 10 permit 10.0.0.0 0.0.0.255      ! matches 10.0.0.0/24
network 10.0.0.0 0.0.0.255 area 0            ! OSPF: enable on 10.0.0.0/24

The /12 trap

The most common mistake is the RFC1918 172.16.0.0/12 block. Its subnet mask is 255.240.0.0, so the wildcard is 0.15.255.255 — not 0.0.255.255. Writing the wrong one leaves guest or internal-deny rules matching a fraction of the range they should. When in doubt, convert it rather than trust muscle memory.

Wildcard mask calculator
Convert any CIDR or mask to its wildcard, with binary view.
Open →
Practise this on today’s Daily Ops Drill — a free network task every day.
Open the app →
Free tools for this
More from the blog
MTU, MSS, and why your VPN tunnels drop large packetsRead →169.254.x.x address on your interface: what APIPA really meansRead →