Network

WireGuard AllowedIPs Calculator

CIDR exclusion

Route everything except…

Subtract networks from AllowedIPs. Results update as you type.
0.0.0.0/0, ::/0 is everything.
The Endpoint from your config. Its IP is excluded so the tunnel can always reach the server.

AllowedIPs: 17 blocks

IPv4: 16 blocks, 65,536 addresses kept outIPv6: 1 block, nothing excluded
AllowedIPs = 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4, 224.0.0.0/3, ::/0
Merging a list rather than subtracting from one? Use the CIDR aggregator.

How AllowedIPs exclusion works

Why WireGuard needs the leftover blocks listed

In WireGuard, AllowedIPs does two jobs: it lists the destinations sent through the tunnel, and the source addresses accepted from the peer. There’s no “exclude” option, so to route everything except some networks you have to list every block that’s left over.

This calculator does that subtraction. Start from 0.0.0.0/0, ::/0 (the whole internet), take out your LAN or any other range, and it returns the shortest exact list of CIDR blocks that remains, ready to paste into the [Peer] section.

Full tunnel
AllowedIPs = 0.0.0.0/0, ::/0: every destination goes through the VPN.
Split tunnel
Only some destinations use the VPN; the rest use your normal connection.
Endpoint
The VPN server’s public IP. It must stay outside AllowedIPs, or the tunnel tries to reach itself.

How to use this tool

Build a split-tunnel AllowedIPs list in four steps
1
Set what the tunnel should carry
Leave 0.0.0.0/0, ::/0 to route everything, or enter the networks you want to reach through the VPN.
2
List what to keep out
Type networks to exclude, or use the presets for private, link-local and other local ranges.
3
Add the server endpoint
Optional, but recommended: its IP is excluded too, so the tunnel’s own packets don’t loop back into it.
4
Paste the result
Copy the AllowedIPs line into the [Peer] section of the client config and reconnect.

Related tools

Keep debugging with tools from the same suite
4 tools
CIDR Aggregator
Merge a list of IPs, ranges and CIDR blocks into the fewest CIDRs, find duplicates and overlaps, and export nginx, Apache, iptables or nftables rules
Subnet Calculator
Calculate IP subnet ranges, network address, broadcast, subnet mask, wildcard mask and usable hosts from any CIDR notation
Public IP
Display your current public IP address, location, and network information
Subnet Mask Cheat Sheet
Printable table of every CIDR prefix from /0 to /32 with subnet mask, wildcard, addresses and usable hosts, plus private ranges and IPv6 sizes

Frequently asked questions

Common questions about WireGuard AllowedIPs
6 Q&A

WireGuard has no exclude syntax, so you list everything except that IP. Put 0.0.0.0/0, ::/0 in the allowed box and the address in the excluded box. This calculator returns the remaining blocks; for one IPv4 address that’s 32 blocks plus ::/0.

Exclude your LAN, or all private ranges with the RFC 1918 preset (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Traffic to those addresses then uses your normal connection, so printers, NAS boxes and the router stay reachable. The Android and Windows apps’ “Exclude private IPs” option does the same thing.

With 0.0.0.0/0, wg-quick on Linux and the official apps route around the endpoint automatically. Once you replace it with a list of blocks, that special handling no longer applies, and if the endpoint is inside one of those blocks, packets meant for the server are sent into the tunnel itself and the connection drops. Excluding the endpoint’s IP avoids that.

If AllowedIPs only covers IPv4, IPv6 traffic bypasses the tunnel and goes out over your normal connection, which can leak your real address. Keeping ::/0 sends IPv6 through the VPN too. If your server has no IPv6, traffic to IPv6 destinations simply fails, and apps fall back to IPv4.

WireGuard itself handles thousands, but each block becomes a route on the client. A few dozen is normal. If your list runs into the hundreds, consider whether you can exclude a larger, simpler range.

Yes. The result is a plain list of CIDR blocks, so it also suits OpenVPN route lines, Tailscale subnet routes, firewall rules or cloud route tables. Use the one-per-line output.