IP Allowlist Generator: Validate CIDR Ranges, Export to Any Format
An IP allowlist is only useful if every entry is actually valid and the list doesn't have silently redundant overlapping ranges. This tool checks each IP/CIDR entry's syntax, flags overlaps, and exports the validated list directly into the format your infrastructure actually needs — nginx, iptables, or AWS Security Group JSON — instead of manually reformatting a plain list.
A bare IP without a /prefix is treated as /32 (a single host).
Why CIDR Overlap Detection Matters
A list with both 203.0.113.0/24 and 203.0.113.5/32 isn't wrong, but the /32 entry is completely redundant — anything it allows is already covered by the /24. Catching this during review keeps allowlists clean and makes it obvious at a glance what's actually being permitted, rather than accumulating years of overlapping, half-remembered entries.
Why Export Format Matters More Than It Seems
The exact syntax for an IP allowlist varies significantly by platform — nginx wants allow/deny directives ending in a catch-all deny, iptables wants full command invocations, and AWS Security Groups want a specific JSON shape for IpPermissions. Generating the target format directly avoids translation mistakes when moving a list between systems.
Treating Single IPs as /32
CIDR notation requires a prefix, but real-world tools and users often just type a plain IP address meaning 'exactly this one host.' Automatically treating a bare IP as /32 (the most specific possible range) matches that intent without requiring users to remember CIDR notation for the simple case.
Practical Examples
Restricting an Admin Panel with nginx
Common infrastructure use case.
- 1.Input: office IP + VPN CIDR range
- 2.Format: nginx allow/deny block
- 3.Paste into the location block for /admin
Building an AWS Security Group Rule
Ready for infrastructure-as-code.
- 1.Input: list of trusted office/VPN CIDRs
- 2.Format: AWS Security Group JSON
- 3.Paste into a CloudFormation template or CLI call
Export Formats
- nginx: allow/deny directive block
- iptables: full ACCEPT rule commands
- Plain list: one CIDR per line
- CSV: comma-separated
- AWS Security Group: JSON IpPermissions
Good Use Cases
- Restricting an internal tool or admin panel by IP
- Converting a list of trusted IPs into infrastructure config
- Catching redundant overlapping ranges before deploying a firewall rule
- Quickly validating a list of IPs pasted from a spreadsheet
Frequently Asked Questions
Why does it flag overlapping ranges as a warning, not an error?
Overlapping CIDR ranges aren't invalid syntax — they're redundant. 203.0.113.0/24 already includes 203.0.113.5/32, so listing both doesn't cause an error, but it does mean one entry is unnecessary and worth cleaning up for clarity.
What does a single IP without a prefix become in the output?
It's treated as a /32 — a CIDR range containing exactly that one address — which is the standard way to express a single host in CIDR notation used by firewall rules and security group configs.
Why generate nginx allow/deny blocks specifically?
It's one of the most common real-world uses for an IP allowlist — restricting access to an admin panel or internal endpoint at the web server level, before a request even reaches your application code.
What's the AWS Security Group JSON format for?
It matches the IpPermissions structure the AWS SDK/CLI and CloudFormation expect for security group ingress rules, letting you paste the generated JSON directly into infrastructure-as-code without manually reformatting a list of IPs.
Does this validate IPv6 addresses too?
No — this tool focuses on IPv4/CIDR validation and the export formats shown. IPv6 CIDR notation follows different range-overlap math, which isn't currently supported here.
Is my IP list sent anywhere?
No, validation and formatting both happen entirely in your browser via plain arithmetic on the IP values — no upload.