WireGuard AllowedIPs calculator
You want everything through the VPN except the printer, the NAS or one address, and WireGuard has no ExcludedIPs setting. The only way is to list every block you do want, which is tedious by hand. Enter what the tunnel should carry and what must stay out; the calculator returns the AllowedIPs line.
Why AllowedIPs, and not an exclude list
In WireGuard, AllowedIPs does two jobs. On the way out, wg-quick and the mobile apps turn it into routes: an address listed there goes through the tunnel. On the way in, it is a filter: a packet from the peer is accepted only if its source address is in the list. Both work on whole CIDR blocks, so leaving out 192.168.1.0/24 from 0.0.0.0/0 means writing the 24 blocks that cover the rest of the IPv4 space. That subtraction is what this page does, for IPv4 and IPv6, and it merges the result into the fewest blocks possible.
Before you paste the line
- Keep the VPN subnet in
- Excluding 10.0.0.0/8 also removes a tunnel subnet such as 10.8.0.0/24, and the client can no longer reach the server's tunnel address. Put that subnet in the third field: it is added back.
- IPv6
- If the allowed list has 0.0.0.0/0 but not ::/0, IPv6 traffic bypasses the tunnel on dual-stack networks. Keep ::/0 in the first field unless you mean it.
- Windows kill-switch
- The Windows client offers "Block untunneled traffic" only when a peer routes 0.0.0.0/0 or ::/0 as a whole. A computed list does not, so that option goes away: decide which you need.
- Per-app split tunnel
- The Android app can exclude applications from the tunnel in the tunnel's settings, which needs no AllowedIPs change. This calculator works by address, for every client.
- Client side only
- Change AllowedIPs in the client's
[Peer]section. On the server, each peer's AllowedIPs stays its own tunnel address (a /32).
Same rule for every device, without the copy and paste
In WireGuard Manager, a peer can be created as "full tunnel, local network still reachable": the client file comes out with this list already computed, the server's tunnel subnet kept in, keys generated and a QR code for the phone. Free for 1 server and 3 peers, Pro at 9 EUR/month for unlimited servers and peers. Already running a server? Paste its wg0.conf in the config checker first, then import it.