Cisco Wildcard Masks: ACLs & OSPF Without Confusion

Wildcard masks are the single most confusing thing in the first month of CCNA study. Not because they’re hard — they’re not — but because they look almost exactly like subnet masks, do the opposite job, and show up in the two topics that everyone practices most (ACLs and OSPF). Get the mental model wrong on day one, and you’ll spend a semester debugging labs that should have worked.

This post fixes the model in about ten minutes.

The one-line mental model

A subnet mask tells the router which bits of an IP address identify the network.

A wildcard mask tells the router which bits of an IP address it should ignore when matching.

• Subnet mask bit 1 → “this bit is part of the network — copy it.”
• Wildcard mask bit 0 → “this bit must match exactly.”
• Wildcard mask bit 1 → “this bit is a wildcard — I don’t care what’s there.”

They’re inverses of each other. That’s the whole idea.

Conversion: subnet mask ↔ wildcard mask

For any subnet mask, the corresponding wildcard is 255.255.255.255 − subnet mask (octet by octet, 255 − x):

Memorize the top block cold — these are what CCNA questions almost always use.

Where wildcard masks actually show up

ACLs (standard and extended) — the “who” and “what” match fields.

OSPF network statements — which local interfaces belong to which OSPF area.

NAT ACLs — same as above, feeding a source list.

Nowhere else in CCNA scope. If you’re not in one of these three, you want a subnet mask, not a wildcard.

Example 1 — ACL

Task: permit any host in 192.168.10.0/24 and deny everyone else.

R1(config)# access-list 10 permit 192.168.10.0 0.0.0.255

Read out loud: “permit any address that matches 192.168.10.0 in the first three octets and can be anything in the fourth.” That’s every host in the /24.

Then apply it inbound on the interface facing the source:

R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip access-group 10 in
R1# show access-lists 10
Standard IP access list 10
    10 permit 192.168.10.0, wildcard bits 0.0.0.255

Note that IOS echoes it back as “wildcard bits 0.0.0.255” — that phrasing is a good exam-day hint that the second value is always a wildcard, never a subnet mask, inside access-list.

Example 2 — OSPF network statement

Task: enable OSPF on all interfaces in the 10.0.0.0/24 range and put them in area 0.

R1(config)# router ospf 1
R1(config-router)# network 10.0.0.0 0.0.0.255 area 0

Read: “for any local interface whose IP falls in 10.0.0.0/24, enable OSPF in area 0.”

To enable OSPF on a single interface whose IP is 10.0.0.1:

R1(config-router)# network 10.0.0.1 0.0.0.0 area 0

A wildcard of 0.0.0.0 means “every bit must match exactly” — i.e. only the one address 10.0.0.1.

Confirm with show ip protocols:

R1# show ip protocols
Routing Protocol is "ospf 1"
  ...
  Routing for Networks:
    10.0.0.1 0.0.0.0 area 0

Example 3 — the non-contiguous trick

Wildcards let you match ranges that a subnet mask cannot express. For example, a wildcard of 0.0.0.3 matches any 4 addresses whose last two bits vary:

R1(config)# access-list 20 permit 10.1.1.0 0.0.0.3

Matches: 10.1.1.0, 10.1.1.1, 10.1.1.2, 10.1.1.3. Same as a /30.

More usefully, 0.0.0.255 in a wildcard with a network like 10.1.0.0 matches the whole 10.1.0.0/24. But 0.0.1.255 matches 10.1.0.0/23 (256 + 256 = 512 addresses).

Two-line mental rule for the wildcard alone:

• Add 1 to it to get the block size.
• Block size + starting IP tells you the range end.

0.0.0.31 + 1 = 32 → this wildcard covers 32-address blocks. Same as /27.

The subnet-mask ↔ wildcard-mask shortcut

If you know the subnet mask, the wildcard is 255 − x per octet. Fast worked example:

Subnet mask 255.255.255.240 (/28). Wildcard = 0.0.0.15. Done.

Subnet mask 255.255.252.0 (/22). Wildcard = 0.0.3.255. Done.

Do this ten times and you’ll never have to think about it again.

The #1 mistake — subnet mask where a wildcard belongs

The single most common CCNA-lab bug — bar none — is typing a subnet mask where the box wants a wildcard. Real IOS will accept it (usually) but the meaning is wrong, so the ACL or OSPF network statement matches nothing (or matches too much) and the lab silently fails.

Wrong (looks right, isn’t):

R1(config-router)# network 192.168.1.0 255.255.255.0 area 0

IOS silently converts and stores network 192.168.1.0 0.0.0.255 area 0 — you get lucky. But on an ACL:

R1(config)# access-list 5 permit 192.168.1.0 255.255.255.0

This does NOT match the /24 you meant. It matches only the exact IP 192.168.1.0 (because on ACLs IOS doesn’t second-guess you). Every host in the /24 fails the ACL, nothing works, and you spend an hour debugging.

How to catch yourself: if the number after the network address has any octet that isn’t 0, 1, 3, 7, 15, 31, 63, 127, or 255 — you’re probably typing a subnet mask by accident. Those are the only valid wildcard-octet values.

Cheat card

Keep this open during labs until it’s second nature:

Places wildcards appear: ACLs, OSPF network statements, NAT source lists.
Everywhere else: subnet mask.

Where to go from here

• The full ACLs topic page walks through standard vs extended and how the wildcard interacts with host and any shortcuts (host 10.0.0.1 = 10.0.0.1 0.0.0.0, any = 0.0.0.0 255.255.255.255).
• The OSPF Single-Area topic shows how the wildcard on a network statement selects which of a router’s interfaces actually run OSPF.
• Drill it on real IOS in the free-play console — configure an ACL with wildcard 0.0.0.15, then use show access-lists to see how the router echoes it.

Nail wildcard masks in week one and half the ACL/OSPF confusion in later chapters evaporates. Get it wrong, and every subsequent chapter compounds the pain.