topic Re: IP Wildcard Mask Address Objects in General Topics

IP Wildcard Mask Address Objects

SARowe_NZ — Wed, 07 Sep 2022 00:17:27 GMT

Hey,

This properly confuses me every time I look at it. Is anyone able to explain in very simple terms how to work out what the mask should be?

For example: We have an IP scheme that looks like 10.x.128.0/24 where the x changes for each site. We have been using an IP Wildcard address object of 10.128.128.0/0.127.127.255 which seems to have been working for sites 10.[128-201].128.0/24 but now we have a site that uses 10.224.128.0/24 and the wildcard address object does not seem to match it.

What is our address object of 10.128.128.0/0.127.127.255 actually covering?

How can I understand easily how to work out what a mask should be?

Thanks!

Shannon

Re: IP Wildcard Mask Address Objects

BPry — Wed, 07 Sep 2022 13:20:16 GMT

@SARowe_NZ,

An easier way of thinking about ACL wildcard mask is reversing what your traditional subnet statement would be. So where a subnet mask of 10.0.0.0/255.255.255.0 would allow for 10.0.0.0-10.0.0.255, a wildcard mask would actually be 0.0.0.255. Essentially stating that you want the wildcard to account for 10.0.0.0-10.0.0.255.

In your given example with 10.128.128.0/0.127.127.255 as a wildcard mask you'd be allowing 10.128.128.0-10.255.255.255.

Re: IP Wildcard Mask Address Objects

SARowe_NZ — Wed, 21 Sep 2022 19:21:24 GMT

Thanks for the response. That is how I thought it was but in initial testing traffic did not seem to match as expected. This is for a new site which is not live yet so I will organize another test when devices are available in the relevant subnets.

Re: IP Wildcard Mask Address Objects

OtakarKlier — Wed, 21 Sep 2022 19:54:18 GMT

Hello,

Check the logs on the subnet (far) side of the network that is not working. Also check the site it cannot reach and make sure the routes are being distributed to that location.

Regards,

Re: IP Wildcard Mask Address Objects

SaurabhB — Fri, 18 Nov 2022 08:20:41 GMT

Routing can be tested via "test routing fib-lookup" command line command. With the same test command, you can also check the security policy match for the traffic.
Also remember - You can use an address object of type - IP Wildcard Mask only in a Security policy rule.

Re: IP Wildcard Mask Address Objects

rmfalconer — Mon, 21 Nov 2022 15:51:37 GMT

It's not quite as easy as it may seem with the wildcard mask you're using. You need to understand how the wildcard mask works to figure out which subnets will be matched.

If your wildcard mask was 0.127.255.255, then everything from 10.128.128.0-10.255.255.255 would match. But your mask is 0.127.127.255, which means some subnets are not going to match in that range.

You'll need to do some binary comparisons to figure out what matches and what doesn't. The matching logic is opposite of subnet masking.

Re: IP Wildcard Mask Address Objects

SARowe_NZ — Mon, 21 Nov 2022 18:14:55 GMT

Yeah thanks - this is my challenge. I am wanting to find an easy/repeatable way of working out what a mask covers, and also what mask would be required to cover a certain range.

Any tips or tools that can be used to do this easily without going through and trying to work out binary and correlating it?

Re: IP Wildcard Mask Address Objects

SaurabhB — Tue, 22 Nov 2022 05:08:49 GMT

You can use online wildcard subnet calculator
IPv4 Wildcard Calculator - SubnetOnline.com

Re: IP Wildcard Mask Address Objects

rmfalconer — Tue, 22 Nov 2022 14:33:13 GMT

Online calculators don't provide for unusual wc masks like you have. I don't know of any that would make it easier in this case.

Do you know why it was set this way originally? Any reason you can't change to 0.127.255.255, which would simplify knowing what would match? Or you could create a new object that will match 10.224+

How is that object being used? You're matching on a lot of potentially unnecessary addresses.

Re: IP Wildcard Mask Address Objects

SARowe_NZ — Tue, 22 Nov 2022 17:30:05 GMT

Yeah, that is the challenge; we're not just trying to match on standard CIDR's so the traditional calculators don't seem to cover our scenario's.

We have a number of sites that use a common scheme for IP addresses, we are wanting to use these wildcards to accurately match traffic for all sites without needing to create individual objects for each site/network. e.g.

Site A:

Corp Clients = 10.224.10.0/24

Corp WiFi = 10.224.88.0/24

Corp Security = 10.224.26.0/24

SCADA = 10.224.128.0/24

PLC = 10.224.129.0/24

Management = 10.224.3.0/24

etc x 20ish

Site B:

Corp Clients = 10.225.10.0/24

Corp WiFi = 10.225.88.0/24

Corp Security = 10.225.26.0/24

SCADA = 10.225.128.0/24

PLC = 10.225.129.0/24

Management = 10.225.3.0/24

etc x 20ish

So the 2nd Octet changes for each site, but the 3rd octet is always the same. We want wildcard masks that match the different address objects (10.x.10.0/24, 10.x.88.0/24) etc. so we only need one address object in the policies for all sites, rather than creating 50-100 address objects for each network to cover all the sites.

To complicate it further we only want to look at addresses where the 2nd octet is 128-255 as lower numbers are unrelated to this use case.

Re: IP Wildcard Mask Address Objects

Jorgen_Lanesskog — Tue, 27 Jun 2023 23:25:44 GMT

Compile this in Delphi Pascal and you have yourself a discontinious wildcard mask calculator 🙂 🙂

unit main;

interface

uses
Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, System.RegularExpressions,
Vcl.Imaging.pngimage, Vcl.ExtCtrls;

type
TForm1 = class(TForm)
Memo: TMemo;
Edit1: TEdit;
Edit2: TEdit;
Button1: TButton;
Button2: TButton;
Image1: TImage;
procedure Button1Click(Sender: TObject);
procedure Button2Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;

type
TIPAddress = record
Octets: array[0..3] of Byte;
end;

var
Form1: TForm1;
stoppressed : boolean;

implementation

{$R *.dfm}

function IPAddressToStr(const IPAddress: TIPAddress): string;
begin
Result := Format('%d.%d.%d.%d', [IPAddress.Octets[0], IPAddress.Octets[1], IPAddress.Octets[2], IPAddress.Octets[3]]);
end;

function IsValidIPAddress(const IPAddress: string): Boolean;
const
ValidOctetPattern = '^(([0-9])|([1-9][0-9])|(1[0-9]{2})|(2[0-4][0-9])|(25[0-5]))$';
var
Octets: TStringList;
I: Integer;
begin
Result := False;
Octets := TStringList.Create;
try
Octets.Delimiter := '.';
Octets.StrictDelimiter := True;
Octets.DelimitedText := IPAddress;

if Octets.Count <> 4 then
Exit;

for I := 0 to 3 do
begin
if not TRegEx.IsMatch(Octets[I], ValidOctetPattern) then
Exit;
end;

Result := True;
finally
Octets.Free;
end;
end;

function StrToIPAddress(const IPAddressStr: string): TIPAddress;
var
IPAddressStrs: TStringList;
I: Integer;
begin
IPAddressStrs := TStringList.Create;
try
IPAddressStrs.Delimiter := '.';
IPAddressStrs.StrictDelimiter := True;
IPAddressStrs.DelimitedText := IPAddressStr;

for I := 0 to 3 do
Result.Octets[I] := StrToIntDef(IPAddressStrs[I], 0);
finally
IPAddressStrs.Free;
end;
end;

procedure ExpandWildcardIP(const IPAddress, WildcardMask: string; Memo: TMemo);
var
IP, Mask: TIPAddress;
StartIP, EndIP: TIPAddress;
CurrentIP: TIPAddress;
I: Integer;
begin
if not IsValidIPAddress(IPAddress) or not IsValidIPAddress(WildcardMask) then
begin
ShowMessage('Invalid IP address or wildcard mask.');
Exit;
end;
IP := StrToIPAddress(IPAddress);
Mask := StrToIPAddress(WildcardMask);
for I := 0 to 3 do
begin
StartIP.Octets[I] := IP.Octets[I] and (not Mask.Octets[I]);
EndIP.Octets[I] := IP.Octets[I] or Mask.Octets[I];
end;
CurrentIP := StartIP;
while not CompareMem(@CurrentIP, @EndIP, SizeOf(TIPAddress)) do
begin
// Check if the current IP address matches the mask
for I := 0 to 3 do
begin
if (CurrentIP.Octets[I] and not Mask.Octets[I]) <> (IP.Octets[I] and not Mask.Octets[I]) then
Break;
end;
if I = 4 then
Memo.Lines.Add(IPAddressToStr(CurrentIP));
application.ProcessMessages;
if stoppressed then
begin
Memo.Lines.Add('Aborted...');
stoppressed := false;
exit;
end;
// Increment the IP address
for I := 3 downto 0 do
begin
Inc(CurrentIP.Octets[I]);
if CurrentIP.Octets[I] <> 0 then
Break;
end;
end;
end;

procedure TForm1.Button1Click(Sender: TObject);
begin
stoppressed := false;
ExpandWildcardIP(edit1.Text, edit2.text, Memo);
end;

procedure TForm1.Button2Click(Sender: TObject);
begin
stoppressed := true;
end;

end.

Re: IP Wildcard Mask Address Objects

Jorgen_Lanesskog — Tue, 27 Jun 2023 23:56:55 GMT

Or you can download the compiled wc.exe here:
jorlan72/Discontiguous-Wildcard-Masks-Calculator: Discontinious Wildcard Mask Callculator (github.com)

Re: IP Wildcard Mask Address Objects

KatAltamura — Fri, 13 Sep 2024 13:57:22 GMT

I just wanted to say thank you for doing that, it saved me time in confirming the wildcard mask I'd need!

Re: IP Wildcard Mask Address Objects

SRowe5 — Sun, 06 Jul 2025 22:23:27 GMT

Belated as I didn't see it at the time and have just stumbled over this again now but this is fantastic! Thanks Jorgen.

Re: IP Wildcard Mask Address Objects

Jorgen_Lanesskog — Sat, 01 Nov 2025 10:36:50 GMT

Online version here: https://www.bitregn.no/wildcard-calculator

Re: IP Wildcard Mask Address Objects

Elwin3 — Fri, 07 Nov 2025 13:18:36 GMT

Hi, that’s a great thread.
Wildcard masks can get confusing fast. The mask 0.127.127.255 doesn’t cover everything from 10.128.0.0 upward because the third octet isn’t fully open. You could simplify it with 0.127.255.255 to include all networks between 10.128.0.0 and 10.255.255.255 or split it into multiple objects if you need tighter control.

https://www.calculator.net/ip-subnet-calculator.html
https://pingmynetwork.com/network/ccna-200-301/what-is-subnetting