WireGuard AllowedIPs Calculator

AllowedIPs is not a preference list. For outbound traffic wg-quick installs a route for every prefix it contains, and for inbound traffic the kernel drops any decrypted packet whose source address is outside it (cryptokey routing). WireGuard has no exclusion syntax, so "send everything except my LAN" must be written as the explicit set of prefixes that remains after the exclusions are removed. This tool does that subtraction per address family and aggregates the result to the minimal equivalent prefix list. Two behaviours are worth knowing before using the output. First, wg-quick special-cases a literal 0.0.0.0/0 or ::/0: it uses a separate routing table with a firewall mark instead of ordinary routes, which is what gives the usual kill-switch behaviour. A split list does not trigger that path, so traffic can fall back to the physical interface if the tunnel goes down. Second, because the same set filters inbound traffic, removing a prefix also stops the peer from being able to send from it. Both sides must agree: your AllowedIPs for a peer should match what that peer is actually allowed to originate. Bare addresses are treated as /32 or /128, host bits are normalized to the network address, and the two families are computed independently. Nothing is sent anywhere and no keys are involved.