Range Union
Merge overlapping IP ranges into a unified list
Input IP Ranges
Format
Enter ranges as start_ip-end_ip
Overlapping and adjacent ranges will be merged.
Merged Ranges
Merged ranges will appear here
The Range Union tool combines multiple IP ranges or CIDR blocks into a clean, non-overlapping list by merging any overlapping or adjacent entries. Enter overlapping blocks like 192.168.0.0/24 and 192.168.0.128/25 to see them merged into a single 192.168.0.0/24, or paste a messy list of ranges accumulated over years to get a clean, normalized output.
Understanding IP Range Union
Over time, firewall rules, allowlists, and network documentation accumulate entries from different sources: one administrator adds a /24 for a new project, another adds a /25 within that same range for a hotfix, and a third adds an adjacent /24 during a migration. The result is a list with redundant overlaps and unnecessarily fragmented entries. Range union cleans this up by computing the set-theoretic union of all inputs and expressing the result as the minimal non-overlapping set of CIDR blocks.
The union operation has a simple definition: an address is in the output if and only if it appears in at least one input range. Unlike a covering CIDR, which might include addresses between non-adjacent ranges, the union only merges ranges that actually touch or overlap. If you have 10.0.0.0/24 and 10.0.5.0/24 with a gap between them, both will appear in the output unchanged. But 10.0.0.0/24 and 10.0.1.0/24 will merge into 10.0.0.0/23 because they are adjacent.
This conservative behavior is what makes range union safe for security rules. You can run your entire firewall ruleset through the union tool and know that the output covers exactly the same addresses as the original -- no more, no fewer. The only thing that changes is the representation: overlaps are eliminated, adjacent blocks are merged, and the total entry count goes down. The security posture stays identical.
How to Merge Overlapping IP Ranges
- Enter a list of IP ranges or CIDR blocks, one per line (supports CIDR notation, start-end ranges, or mixed formats)
- The tool identifies all overlapping and adjacent entries
- It merges them into the minimal non-overlapping set that covers the same total address space
- Review the merged output with before/after statistics showing the reduction achieved
Range Union Examples
Overlapping CIDRs
Input: Output:
192.168.0.0/24 --> 192.168.0.0/24
192.168.0.128/25
The /25 (192.168.0.128 - 192.168.0.255) is entirely within the /24 (192.168.0.0 - 192.168.0.255), so the union is just the /24.
Adjacent CIDRs
Input: Output:
192.168.0.0/24 --> 192.168.0.0/23
192.168.1.0/24
These two /24 blocks are adjacent and merge into a single /23.
Multiple Overlapping Ranges
Input: Output:
10.0.0.0/24 --> 10.0.0.0/23
10.0.0.128/25
10.0.1.0/24
10.0.1.0/25
All four entries overlap or are adjacent, producing a single /23 that covers the entire range.
Non-Overlapping Ranges (No Merge)
Input: Output:
192.168.0.0/24 --> 192.168.0.0/24
192.168.5.0/24 192.168.5.0/24
These ranges are not adjacent or overlapping, so they remain separate. Unlike a covering CIDR, the union does not fill the gap between them.
Mixed Format Input
Input: Output:
10.0.0.0 - 10.0.0.255 --> 10.0.0.0/23
10.0.1.0/24
10.0.0.200/32
Start-end ranges, CIDR blocks, and single IPs can all be mixed in the input.
When to Use the Range Union Tool
- Firewall rule cleanup -- over time, rules accumulate from different administrators or change requests, leading to overlapping entries that slow packet processing and complicate audits
- Allowlist consolidation -- merge allowlists from multiple sources (different teams, acquired companies, vendors) into a single authoritative list
- Network inventory normalization -- combine overlapping address allocations from legacy documentation into a clean, canonical list
- ACL optimization -- reduce the number of access control entries by merging overlaps, improving both performance and readability
- Compliance reporting -- produce a clean, deduplicated list of protected or monitored IP ranges for audit purposes
- Pre-migration cleanup -- before importing rules into a new firewall platform, normalize the list to avoid importing redundant entries
How Range Union Differs from Aggregation
It is important to understand the distinction between union and aggregation:
| Operation | Behavior | Fills Gaps? |
|---|---|---|
| Union | Merges ranges that overlap or touch | No |
| Aggregation | Combines adjacent CIDR blocks into larger blocks | No |
| Covering CIDR | Finds one CIDR that contains all inputs | Yes |
Range union and aggregation are closely related but differ in implementation. Union operates on arbitrary ranges and produces the minimal non-overlapping representation. Aggregation operates specifically on CIDR blocks and uses binary merging rules. In practice, both produce similar results for well-formed CIDR inputs.
The Union Algorithm
- Normalize all inputs to start-end integer ranges
- Sort ranges by start address
- Iterate through sorted ranges, merging each with the previous if they overlap or are adjacent (current start <= previous end + 1)
- Convert merged ranges back to minimal CIDR notation
Practical Tips for Range Normalization
The best time to run a range union is right before an audit or a firewall migration. Before an audit, a clean non-overlapping list is much easier for reviewers to scan, and it eliminates the questions about why the same address appears in multiple rules. Before a migration, normalizing the list reduces the number of rules you need to import and ensures you are not carrying forward years of accumulated redundancy.
When consolidating allowlists from multiple teams or acquired companies, expect significant overlap. It is common to find that 40-60% of entries are redundant when you merge lists from different sources. The union tool gives you an exact count of how many entries were eliminated, which is useful for justifying the cleanup effort to management.
Be aware that the union tool merges ranges purely based on address overlap. It does not consider the original purpose of each rule. Two rules might cover the same addresses but have different intents (one allows HTTP, another allows SSH). The union tool merges the addresses, but you still need to manage the rule logic separately. Union is for normalizing address ranges, not for consolidating complete firewall rules with their associated protocols and ports.
Frequently Asked Questions
Does union ever include addresses that were not in any input?
No. Union only merges ranges that overlap or are directly adjacent (touching). It never fills gaps between non-contiguous ranges. If 10.0.0.0/24 and 10.0.5.0/24 are the inputs, the gap from 10.0.1.0 to 10.0.4.255 remains uncovered.
What happens with duplicate entries?
Duplicates are automatically eliminated. If the same CIDR appears five times in your input, it appears once in the output. This makes the tool useful as a simple deduplication step even when no overlaps exist.
Can I use this to find how many unique addresses are in my list?
Yes. The union output shows the total address count across all merged ranges, which represents the number of unique addresses covered by at least one input range. This is particularly useful for sizing network allocations or understanding the true scope of a blocklist.
What is the difference between union and intersection?
Union produces addresses that are in A or B (or both). Intersection produces addresses that are in A and B (only the overlap). Union combines, intersection isolates. Use Range Intersection when you need to find shared addresses between two ranges.
Can I process thousands of ranges at once?
Yes. The sort-and-merge algorithm runs in O(n log n) time, where n is the number of input ranges. Even thousands of entries process in milliseconds.
Related Tools
- Range Intersection - Find common addresses between two IP ranges
- Range Difference - Calculate A minus B for IP ranges
- CIDR Aggregator - Aggregate multiple CIDR blocks into summarized routes
- CIDR List to Minimal Non-overlapping Set - Convert a CIDR list to minimal non-overlapping blocks
- Minimal Merge Tool - Merge all mergeable CIDR blocks in a list