Octet

Say this first

A wildcard mask tells the ACL which bits of the address to check. A 0 bit means "must match", a 1 bit means "ignore". For a normal subnet it is the inverse of the subnet mask, so I subtract each mask octet from 255. A /24 is 0.0.0.255, a /27 is 0.0.0.31, a /20 is 0.0.15.255. host 10.1.1.5 means wildcard 0.0.0.0 and any means 0.0.0.0 255.255.255.255.

Go deeper

Worked examples

Match	Subnet mask	Wildcard	ACL entry
192.168.10.0/24	255.255.255.0	0.0.0.255	`192.168.10.0 0.0.0.255`
10.1.4.0/22 (10.1.4.0 to 10.1.7.255)	255.255.252.0	0.0.3.255	`10.1.4.0 0.0.3.255`
172.16.16.0/20	255.255.240.0	0.0.15.255	`172.16.16.0 0.0.15.255`
10.10.10.32/27 (.32 to .63)	255.255.255.224	0.0.0.31	`10.10.10.32 0.0.0.31`
10.10.10.4/30	255.255.255.252	0.0.0.3	`10.10.10.4 0.0.0.3`
one host 10.1.1.5	255.255.255.255	0.0.0.0	`host 10.1.1.5`

Turning a range into a wildcard

"Match 10.1.4.0 to 10.1.7.255." Third octet 4 is 00000100, 7 is 00000111. Only the last two bits change, so the third octet of the wildcard is 00000011 = 3: 10.1.4.0 0.0.3.255.

The range has to start on a boundary. 10.1.5.0 to 10.1.8.255 is not one block, so it takes three lines:

Cisco IOS

ip access-list extended RANGE-5-TO-8
 10 permit ip 10.1.5.0 0.0.0.255 any
 20 permit ip 10.1.6.0 0.0.1.255 any
 30 permit ip 10.1.8.0 0.0.0.255 any

Where wildcards are used

IOS ACLs, and OSPF and EIGRP network statements. Prefix lists use prefix lengths instead, Cisco ASA ACLs use normal subnet masks, and Junos firewall filters use prefix notation.

They will ask next

What is the fastest way to do it under pressure?
255 minus each octet of the mask. A /21 has mask 255.255.248.0, so the wildcard is 0.0.7.255. Or count the block size and subtract one: a /21 is 8 in the third octet, wildcard 7.
Is a wildcard always the inverse of a subnet mask?
No. The 1 bits do not have to be contiguous, so one line can match patterns like every odd subnet. That is legal in IOS ACLs and impossible with a subnet mask or a prefix list.

Traps

Writing a subnet mask where a wildcard belongs. permit 10.1.1.0 255.255.255.0 ignores the first three octets and checks only that the last one is 0, so it matches every address ending in .0.

How did you do?Book 3.3 Internet (IP)