cf-ips-subnets

View script Copied!

Expand Cloudflare IPv4 ranges into /16 and /24 subnets. Fetches Cloudflare's published CIDR ranges and breaks them down into the largest compatible subnet size (either /16 or /24) that fits within the original range -- perfect for when your firewall or load balancer only accepts these standard prefix sizes.

Some network infrastructure (especially legacy systems) only allows you to specify /16 or /24 CIDR blocks for allowlisting. Cloudflare publishes their IP ranges in various sizes -- /20, /22, etc. -- which these systems reject. This tool bridges the gap by expanding each published range into a list of /16 or /24 subnets you can paste directly into your configuration.

Quick start

$ cf-ips-subnets
173.245.48.0/24
173.245.49.0/24
173.245.50.0/24
173.245.51.0/24
173.245.52.0/24
173.245.53.0/24
173.245.54.0/24
173.245.55.0/24
173.245.56.0/24
173.245.57.0/24
173.245.58.0/24
173.245.59.0/24
173.245.60.0/24
173.245.61.0/24
173.245.62.0/24
173.245.63.0/24
103.21.244.0/24
103.21.245.0/24
103.21.246.0/24
103.21.247.0/24
...

Common examples

Pipe to a file for import into your firewall:

$ cf-ips-subnets > cloudflare-subnets.txt

Count how many /24 blocks you'll need:

$ cf-ips-subnets | wc -l
     450

Allowlist in iptables:

$ cf-ips-subnets | while read subnet; do
  iptables -A INPUT -s "$subnet" -p tcp --dport 443 -j ACCEPT
done

How it works

The script fetches Cloudflare's official IPv4 list from https://www.cloudflare.com/ips-v4, which returns ranges like 173.245.48.0/20 or 103.21.244.0/22. For each range:

If the prefix is larger than /16 (fewer addresses), it expands to /16 blocks
If the prefix is /17 to /24, it expands to /24 blocks
If the prefix is already /24, it's returned as-is (one subnet)
Ranges larger than /24 (e.g., /25 to /32) are rejected with an error, since they can't be represented as /16 or /24 subnets

This logic ensures you get the fewest number of subnet entries while staying within /16 or /24 boundaries.

Reference

All options

Flag	Description
`-h, --help`	Show help

Exit codes

Code	Meaning
0	Success
1	Runtime failure (empty fetch response, or CIDR range > /24 encountered)
3	Dependency error (`curl` or `ipcalc` not found)

Dependencies

Tool	Purpose	Notes
`curl`	Fetch Cloudflare IP list	System default is fine
`ipcalc`	Subnet calculation	Requires github.com/kjokjo/ipcalc

The script checks for ipcalc at startup and exits with an error if it's not available.

Behavior

The script always fetches the latest IP list from Cloudflare on each run -- no caching
Output is printed to stdout, one subnet per line, in the order Cloudflare publishes them
The first line of ipcalc output (the original CIDR range) is stripped out via sed 's/Network: *// ; s/ *$// ; 1d'
IPv6 ranges are not handled (Cloudflare publishes them separately at /ips-v6)