Wildcard Mask Bits #1
Router(config)#access-list 50 deny 192.168.1.0 0.0.0.255
Router(config)#access-list 50 permit any
Router(config-if)#ip address 192.168.5.1 255.255.255.0
Router(config-if)#ip access-group 50 out
Although maybe not a perfect explanation, it is often easiest to see wildcard masks as being just the opposite of subnet masks. The subnet mask 255.255.255.0 identifies the network, the wildcard mask 0.0.0.255 identifies the hosts.
A subnet mask is a 32-bit value made up of contiguous 1s and then 0s.
A wildcard is a 32-bit value made up of contiguous 0s indicating a “must match” and then 1s.
In the above example, the 0s mean the first 3 octets must match exactly. The 255 means any value from 0 to 255 can be here.
Both actually occur in binary and can often be understood only in binary.