Cloudflare CIDR Helper

Cloudflare IP Access Rules do not accept an arbitrary prefix length. An IPv4 entry must be a single address, a /24, or a /16; an IPv6 entry must be a single address, a /64, a /48, or a /32. A list of arbitrary CIDRs therefore has to be rewritten before it can be entered, and the tempting shortcut — rounding a /22 up to a /16 — silently covers 64 times more addresses than intended. This tool never widens a prefix. It aggregates the input first, so redundant and adjacent entries collapse, then expands each remaining prefix into the next longer supported length, which covers exactly the same addresses. A /22 becomes four /24 entries, a /14 becomes four /16 entries, and a /26 becomes 64 single addresses. Expansion stops at 256 entries; past that the honest answer is to restructure the list rather than round it off. The ip.src expression is built from the aggregated list, not the expanded one, because the Ruleset Engine accepts CIDR notation directly — confirm the prefix lengths your specific product and plan accept before pasting it. Two things this tool deliberately does not do: it holds no list of Cloudflare's own IP ranges, so it never tells you whether an address belongs to Cloudflare, and it contacts no Cloudflare API, so nothing you paste leaves the page.