Firewall Allowlist Tidier: The Same Access in Fewer Rules
Paste an allowlist that has grown over the years. Duplicates and overlaps go, neighbouring ranges merge, and you get the shortest list that allows exactly the same addresses, ready for your firewall.
Your Allowlist
IPv4 and IPv6, single addresses or CIDRs, one per line or separated by commas or spaces. Anything after a # is ignored. Everything stays in your browser.
Keeping an Allowlist Honest
Label every entry. An address nobody can name gets left in for years. Keep the list in the repository with a comment on each line: who, why, and when it was added.
Review it twice a year. Offices move, contractors leave and monitoring services change their addresses. Remove anything that can't be named.
Watch the wide ranges. A /16 is 65,536 addresses. If it's there because a provider's address kept changing, a VPN or a fixed address does the same job with one.
Mind the rule limits. AWS security groups take 60 inbound rules each by default, and other clouds have their own caps. A tidied list often gets back under the limit without losing anyone.
Questions
How do I merge IP addresses into CIDR ranges?
Paste them into the tidier above. It removes duplicates and addresses already inside a listed range, joins ranges that touch, and writes the result as the fewest CIDR blocks that cover exactly the same addresses, no more. 10.0.0.0/25 and 10.0.0.128/25 become 10.0.0.0/24.
Does merging allow any extra addresses?
No. The tidier only joins ranges that are next to each other or overlap, so the new list allows exactly the addresses the old one did. It never rounds a range up to a wider block to save a rule.
How many rules can an AWS security group have?
By default 60 inbound and 60 outbound rules per security group, counted separately for IPv4 and IPv6, and each CIDR is one rule. You can ask AWS to raise the quota, but the rules per group multiplied by the groups per network interface has its own ceiling, so tidying the list first is usually the better fix.
What does "host bits set" mean?
A CIDR block should start on its own boundary: 192.168.1.0/24, not 192.168.1.10/24. Most firewalls quietly treat 192.168.1.10/24 as 192.168.1.0/24, which may allow more than whoever added it meant. The tidier shows which entries were like that.
Should I allow a whole cloud provider's range?
Almost never. Allowing a provider's published ranges lets in every customer of that provider, including attackers renting a server for an hour. Allow the fixed addresses of the services you actually use, or use the provider's own private networking.
Is an IP allowlist enough to secure a service?
It is a strong layer, not the only one. Offices change ISP, home addresses change, and an allowed address can be compromised. Keep strong authentication behind the allowlist, and review the list at least twice a year, removing what nobody can name.
Firewall Rules Nobody Can Explain?
I audit what's open and to whom across your servers and cloud accounts, tidy it, and write down why each rule exists.