diff --git a/docs/network.md b/docs/network.md
index ea6cfd7f..c2d51491 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -9,3 +9,11 @@ The `getHostByName` receives a domain name and returns the ip address.
 ```
 getHostByName "www.google.com" would return the corresponding ip address of www.google.com
 ```
+
+## cidrNetmask
+
+The `cidrNetmask` takes in a cidr and returns the netmask.
+
+```
+cidrNetmask "1.2.3.4/32" would return 255.255.255.255
+```
diff --git a/functions.go b/functions.go
index 57fcec1d..943cbd3c 100644
--- a/functions.go
+++ b/functions.go
@@ -22,8 +22,7 @@ import (
 //
 // Use this to pass the functions into the template engine:
 //
-// 	tpl := template.New("foo").Funcs(sprig.FuncMap()))
-//
+//	tpl := template.New("foo").Funcs(sprig.FuncMap()))
 func FuncMap() template.FuncMap {
 	return HtmlFuncMap()
 }
@@ -269,6 +268,7 @@ var genericMap = map[string]interface{}{
 
 	// Network:
 	"getHostByName": getHostByName,
+	"cidrNetmask":   cidrNetmask,
 
 	// Paths:
 	"base":  path.Base,
@@ -336,20 +336,20 @@ var genericMap = map[string]interface{}{
 	"mustChunk":   mustChunk,
 
 	// Crypto:
-	"bcrypt":            bcrypt,
-	"htpasswd":          htpasswd,
-	"genPrivateKey":     generatePrivateKey,
-	"derivePassword":    derivePassword,
-	"buildCustomCert":   buildCustomCertificate,
-	"genCA":             generateCertificateAuthority,
-	"genCAWithKey":      generateCertificateAuthorityWithPEMKey,
-	"genSelfSignedCert": generateSelfSignedCertificate,
+	"bcrypt":                   bcrypt,
+	"htpasswd":                 htpasswd,
+	"genPrivateKey":            generatePrivateKey,
+	"derivePassword":           derivePassword,
+	"buildCustomCert":          buildCustomCertificate,
+	"genCA":                    generateCertificateAuthority,
+	"genCAWithKey":             generateCertificateAuthorityWithPEMKey,
+	"genSelfSignedCert":        generateSelfSignedCertificate,
 	"genSelfSignedCertWithKey": generateSelfSignedCertificateWithPEMKey,
-	"genSignedCert":     generateSignedCertificate,
-	"genSignedCertWithKey": generateSignedCertificateWithPEMKey,
-	"encryptAES":        encryptAES,
-	"decryptAES":        decryptAES,
-	"randBytes":         randBytes,
+	"genSignedCert":            generateSignedCertificate,
+	"genSignedCertWithKey":     generateSignedCertificateWithPEMKey,
+	"encryptAES":               encryptAES,
+	"decryptAES":               decryptAES,
+	"randBytes":                randBytes,
 
 	// UUIDs:
 	"uuidv4": uuidv4,
diff --git a/network.go b/network.go
index 108d78a9..aa014d26 100644
--- a/network.go
+++ b/network.go
@@ -10,3 +10,11 @@ func getHostByName(name string) string {
 	//TODO: add error handing when release v3 comes out
 	return addrs[rand.Intn(len(addrs))]
 }
+
+func cidrNetmask(cidr string) string {
+	_, ipnet, err := net.ParseCIDR(cidr)
+	if err != nil {
+		panic(err)
+	}
+	return net.IP(ipnet.Mask).String()
+}
diff --git a/network_test.go b/network_test.go
index 9c153f0a..a9631134 100644
--- a/network_test.go
+++ b/network_test.go
@@ -16,3 +16,11 @@ func TestGetHostByName(t *testing.T) {
 	assert.NotNil(t, ip)
 	assert.NotEmpty(t, ip)
 }
+
+func TestCidrNetmask(t *testing.T) {
+	tpl := `{{"1.2.3.4/32" | cidrNetmask}}`
+	netmask, _ := runRaw(tpl, nil)
+	assert.NotNil(t, netmask)
+	assert.NotEmpty(t, netmask)
+	assert.Equal(t, "255.255.255.255", netmask)
+}