IPv6 Wildcard Mask Calculator

May 5, 2026

IPv6 Wildcard Mask Calculator

Convert IPv6 prefixes into wildcard masks, match spans, and child subnet ranges for ACLs, lab plans, and route filters.

📋Preset Scenarios

⚙Wildcard Inputs

IPv6 base address Use compressed IPv6 or an IPv4-mapped tail. Block prefix length Common LAN and ACL blocks start near /64. Calculation mode Changes the summary language and fit hints. Address scope Matches the address block to a real IPv6 range. Desired child subnets Used to compute a safe child-prefix window. Addresses per child Enter a large host target for /64 planning. Growth buffer % Adds room before the prefix fit is tested. Output format Controls how the wildcard mask is displayed. Hardware profile Adds rule-budget context to the breakdown.

Live IPv6 matching

Ready to evaluate the current prefix and wildcard plan.

Wildcard masks are the inverse of the prefix, so the fit window and address span update together.

ACL wildcard

Wildcard Mask

::ffff:ffff:ffff:ffff

inverse of the prefix

Shows the exact ACL-style mask for the block.

Prefix and Host Bits

/64

64 host bits

The active block size comes from the prefix.

Match Span

2^64

exact address count

First and last addresses are shown in the breakdown.

Safe Child Window

/52 to /64

child prefix window

Indicates where subnet and host needs both fit.

Full Breakdown

💻Hardware and Spec Grid

Home gateway

8 W

0U, 4 ports

Small ACL table, simple prefix list support.

Firewall box

14 W

1U, 4 ports

Stateful rules and route-policy checks.

Managed switch

22 W

1U, 24 ports

Good for VLAN ACLs and prefix anchoring.

Lab server

70 W

2U, dual 10G

Useful for route tests and virtual routers.

📈Reference Tables

Prefix	Wildcard	Host Bits	Span
/128	::	0	1
/127	::1	1	2
/64	::ffff:ffff	64	2^64
/48	::ff:ffff	80	2^80

Scope	Range	Typical Prefix	Use
Global	2000::/3	/64	Routed LANs
ULA	fc00::/7	/48	Private labs
Link-local	fe80::/10	/64	Neighbor links
Doc	2001:db8::/32	/48	Examples

Plan	Prefix	Host Count	Note
LAN	/64	2^64	Standard subnet
P2P	/127	2	Two-end link
Loopback	/128	1	Single address
Site block	/48	2^80	Large allocation

Device	Power	Ports	IPv6 note
Home router	8 W	4x1G	Basic filters
Firewall	14 W	4x1G	Stateful ACLs
Switch	22 W	24x1G	VLAN policy
Server	70 W	2x10G	Lab routes

Tip: The wildcard is always the inverse of the prefix mask.

Tip: /64 is the normal IPv6 LAN target.

IPv6 wildcard masks are usually used as inverse prefix filters for ACLs and lab planning, so this calculator keeps the prefix, range, and child fit window synchronized.

Wildcard mask are used to match ranges of IPv6 addresses. The wildcard mask use the inverse of the subnet mask to indicate which bit are to be “wildcard” bits. By using wildcard bits, the wildcard mask allow for the matching of a range of addresses with the wildcard mask.

Wildcard masks is used in access control lists to permit or deny ranges of addresses to network devices. When planning an IPv6 network, its important to understand how prefixes and subnet work. A /64 prefix is the most common for IPv6 networks.

Using IPv6 Wildcard Masks to Plan Networks

Using a /64 prefix leave 64 bits for the host addresses of the network. Because there are 2 to the power of 64 addresses that can be represented by 64 bits, using a /64 prefix allow for a very large number of addresses for each network. Using a wildcard mask of ::ffff:ffff will allow the access control list to match all address within the host portion of the IPv6 address.

When planning an IPv6 network, one must plan for growth to ensure that there will be enough subnets for network devices in the future. If a person wish to create 16 subnets, for example, they must plan for growth to ensure that each of those subnet has enough addresses for the network devices that will connect to those networks. Additionally, a person must plan for the hardware that will be utilize in the network.

A home router may not be able to handle very deep access control lists. A switch could potentially handle such lists. Finally, a person must select the correct address scope for the network.

Global unicast addresses are used for public networks, unique local addresses are used for private networks (like laboratories), and link local addresses are used for discovery of neighboring network devices. Using a global unicast address space for link local addresses will result in the wildcard mask failing to function correctaly. There are specific output for an access control list software tool that will allow a network designer to determine if there subnetting is correct.

The display of wildcard addresses will show which addresses will match the wildcard mask. The span will show the total number of addresses in that range. Additionally, the safe child window will calculate the correct prefix for the network based on the number of subnets and hosts.

If the prefix is too small, there will be too many fragments on the network. If the prefix is too large, there will be wasted addresses. A common mistake in using an IPv6 address with a wildcard mask is to ignore the canonical base address.

The input address for a prefix must be normalize to the beginning of the address block, or else the wildcard mask will not match the addresses correctly. There are presets for creating a wildcard mask very quick. Additionally, there are reference tables for understanding the various prefix lengths for IPv6 addresses.

For example, a /127 prefix contain only two addresses, and it can be used for linking two routers together. The wildcard mask can work in three different mode. Access control list mode use the inverse of the subnet mask.

Subnet planning mode can allow a network designer to check how many address are available for each network. Route filter mode use the wildcard mask to prioritize IPv6 route summaries. Both wildcard masks are tools used in real networks to support the growing number of networks, devices, and routing information.