AllowedIPs Calculator

Exact CIDR subtraction: a base range minus what stays outside the tunnel. computed in your browser

Base range Your LAN (for the chip below)

Exclude these ranges, one per line All RFC1918 My LAN Multicast and reserved Clear

Enter a base range and what to leave out.

Why WireGuard needs the whole list spelled out

WireGuard has no "except" syntax. Keeping a LAN outside the tunnel means listing 0.0.0.0/0 minus it as CIDR blocks.

What excluding a range actually does

Leaving a range out of AllowedIPs keeps it off the tunnel. That traffic leaves your machine unencrypted, visible to your ISP and local network. Fine for a printer, a leak for anything else. AllowedIPs also filters inbound: packets from a source outside the list are dropped.

Limits of this page

Exact subtraction, checked against brute-force address-by-address comparison. Blind to your routing table, firewall, and a DNS server inside an excluded range (the classic "tunnel up, nothing resolves"). No preset maps a country or ISP to ranges; nothing does that honestly.

Related screens

All VPN tools Leak test Exit IP inspector VPN chooser

Read the guide

What a VPN actually does Network security fundamentals