CIDR Overlap Checker
Check whether two CIDR ranges overlap — catches conflicting firewall/routing rules before they cause an outage.
Overlapping CIDR ranges cause outages and, worse, silent security failures — a firewall rule that unintentionally covers more than intended, or a VPC peering that cannot be established. Checking overlap by eye is error-prone in a way that checking it arithmetically is not.
How to use it
- Enter CIDR A.
- Enter CIDR B.
- Read whether they overlap, and how.
What to take away
Containment is a kind of overlap
10.0.0.0/8 fully contains 10.1.2.0/24. Any rule written against the larger block silently applies to the smaller one.
Cloud networks fail loudly on this
VPC peering and VPN tunnels refuse overlapping address space outright, which is the most common reason a peering request is rejected.
Allow rules are where it bites
A deny rule that overlaps too much causes an outage you notice immediately. An allow rule that overlaps too much causes exposure you do not notice at all.
Frequently asked questions
Why does overlapping address space break VPN and peering?
Routing needs one unambiguous destination for a prefix. When both sides claim the same range, there is no correct answer, so the connection is refused rather than silently misrouted.
How should I plan ranges to avoid this?
Allocate non-overlapping blocks per environment and region from the start, and keep the allocation written down somewhere authoritative. Retrofitting a renumbering is painful.
Is a /32 a valid CIDR?
Yes — it is a single host, and it is extremely common in firewall rules where you want to permit exactly one address.
Where this fits in the course
This security tool pairs with Path 02 — Networking — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Subnet Calculator — IPv4 CIDR → network, broadcast, host range, mask, and host count.
- VLSM Subnet Planner — Plan variable-length subnets across several different host-count requirements from one base network.
- Security Header Analyzer — Paste HTTP response headers and get a graded report on the security headers present and missing.
- SSRF Playground — A "fetch this URL for me" feature with no allowlist. Point it at internal-looking addresses and see what it leaks.