WireGuard AllowedIPs Calculator
The WireGuard AllowedIPs calculator takes a base range, such as 0.0.0.0/0 and ::/0, removes the ranges you want left outside the tunnel, and gives the minimal list of CIDR blocks to paste into a peer. It is for anyone who needs a full tunnel that still reaches the local network.
Exact BigInt arithmetic for IPv4 and IPv6. Nothing you type leaves your browser.
Where does this address go?
How the calculator works
WireGuard has no "except" syntax, so 0.0.0.0/0 minus a LAN must be listed as CIDR blocks. The calculator subtracts each exclusion from the base ranges by halving any block that partly overlaps it, drops the halves the exclusion covers, then merges sibling blocks back together so the list is as short as possible.
- Inputs can be CIDR blocks, bare addresses, start-end ranges or a pasted AllowedIPs line. Ranges are converted to the smallest set of CIDR blocks that covers them.
- Host bits are masked off the way WireGuard does it, so 192.168.1.5/24 means 192.168.1.0/24. The page tells you when that happens.
- Exclusions outside the base, or in a family the base does not include, are listed as ignored.
- Each excluded range is matched against the IANA IPv4 and IPv6 special-purpose registries and marked local, not routed, or public.
The page cannot see your routing table, firewall, or which DNS server you use. Check your DNS server with the address box.
How to read the result
- Blocks is the number of CIDR entries in the AllowedIPs line. Each one becomes a route; above 100 the tile turns amber.
- IPv4 and IPv6 in tunnel is the share of the base range that still goes through the tunnel, with the exact count of addresses that bypass it.
- Check next lists what to look at: IPv6 left outside the tunnel, a LAN still inside it, public ranges you excluded, and very long lists.
- What you excluded marks each range as local (stays on the LAN or host), not routed (never routed on the internet) or public (traffic to it skips the VPN).
- The Map tab shows one cell per sub-block: green is in the tunnel, amber partly, red bypasses. The red marks on the strip are your exclusions at true scale.
Excluded traffic leaves the machine without WireGuard encryption. AllowedIPs also filters inbound: a source outside the list is dropped.
FAQ
Why can't I just tell WireGuard to exclude my LAN?
WireGuard has no except syntax. AllowedIPs is a plain list of ranges to route into the tunnel, so 0.0.0.0/0 minus a LAN has to be written out as every CIDR block that remains. This calculator does that subtraction.
Is traffic to an excluded range encrypted?
No. Excluded traffic leaves the machine outside the tunnel without WireGuard encryption, so anyone on that network can see its addresses and any content an app does not encrypt itself, such as plain DNS or HTTP. AllowedIPs also filters inbound: a packet from a source outside the list is dropped.
Why does one exclusion produce so many blocks?
Removing a range from a larger block leaves one block per prefix length between them, so excluding a /24 from 0.0.0.0/0 leaves 24 IPv4 blocks. Each block becomes a route. Above 100 blocks the page warns, because long lists install slowly and some mobile clients reject them.
What input formats does it accept?
CIDR blocks, bare addresses, start-end ranges and pasted AllowedIPs lines, separated by commas or new lines. A # starts a comment. IPv4 parts with leading zeros are rejected because some stacks read them as octal.
Are my ranges sent to a server?
No. Parsing, subtraction and merging run in your browser with exact BigInt arithmetic. The page cannot see your routing table, firewall or DNS settings, so check your DNS server with the address box.
Rules: RFC 4632, RFC 5952. Range classes: IANA IPv4 and IPv6 special-purpose registries. Part of the pwnsy VPN tools.