diff --git a/TunnelKit/Sources/Core/RoutingTableEntry.h b/TunnelKit/Sources/Core/RoutingTableEntry.h
index f0f2b46..da44425 100644
--- a/TunnelKit/Sources/Core/RoutingTableEntry.h
+++ b/TunnelKit/Sources/Core/RoutingTableEntry.h
@@ -35,6 +35,7 @@ NS_ASSUME_NONNULL_BEGIN
 - (BOOL)isIPv6;
 - (NSString *)network;
 - (NSInteger)prefix;
+- (nullable NSString *)networkMask; // nil if IPv6
 - (nullable NSString *)gateway;
 - (NSString *)networkInterface;
 
diff --git a/TunnelKit/Sources/Core/RoutingTableEntry.m b/TunnelKit/Sources/Core/RoutingTableEntry.m
index 952e857..5807a3a 100644
--- a/TunnelKit/Sources/Core/RoutingTableEntry.m
+++ b/TunnelKit/Sources/Core/RoutingTableEntry.m
@@ -176,6 +176,14 @@ static NSString *RoutingTableEntryName(struct sockaddr *sa, struct sockaddr *mas
     }
 }
 
+- (NSString *)networkMask
+{
+    struct in_addr mask;
+    mask.s_addr = htonl(~((1 << (32 - self.prefix)) - 1));
+    const char *address = inet_ntoa(mask);
+    return [NSString stringWithCString:address encoding:NSASCIIStringEncoding];
+}
+
 - (BOOL)isDefault
 {
     return [self.network isEqualToString:@"default"];
diff --git a/TunnelKitTests/RoutingTests.swift b/TunnelKitTests/RoutingTests.swift
index be48038..3fbaa3c 100644
--- a/TunnelKitTests/RoutingTests.swift
+++ b/TunnelKitTests/RoutingTests.swift
@@ -38,6 +38,7 @@ class RoutingTests: XCTestCase {
     
     func testEntryMatch4() {
         let entry24 = RoutingTableEntry(iPv4Network: "192.168.1.0/24", gateway: nil, networkInterface: "en0")
+        print(entry24.networkMask()!)
         for i in 0x0...0xff {
             XCTAssertTrue(entry24.matchesDestination("192.168.1.\(i)"))
         }
@@ -46,6 +47,7 @@ class RoutingTests: XCTestCase {
         }
 
         let entry28 = RoutingTableEntry(iPv4Network: "192.168.1.0/28", gateway: nil, networkInterface: "en0")
+        print(entry28.networkMask()!)
         for i in 0x0...0xf {
             XCTAssertTrue(entry28.matchesDestination("192.168.1.\(i)"))
         }