VPNSmith
Free tool - WireGuard split tunneling

WireGuard AllowedIPs calculator

WireGuard has no "exclude" setting: to route everything except your LAN or one address, AllowedIPs must list every other network. Enter what the tunnel should carry and what it should skip, and get the exact AllowedIPs line, a ready [Peer] block and the commands to check the routes. Everything runs in your browser.

Want full control over what goes through the tunnel? Run your own WireGuard server: see the Contabo VPS offer

Runs entirely in your browser. Nothing you type leaves the page.

Usually 0.0.0.0/0, ::/0 (everything). For a tunnel that only reaches a remote network, enter that network instead, for example 10.0.0.0/24. Separate entries with commas, spaces or new lines.

Your LAN, private ranges or single addresses (a bare IP counts as /32 or /128).

Added back after the exclusions. Put your WireGuard tunnel subnet here if it falls inside an excluded range.

An IP address, not a hostname. It is excluded as a single address, which prevents the Linux routing loop.

Route test commands for
  • On Linux with wg-quick, a list without /0 that covers the server's public IP sends the encrypted packets into the tunnel. Enter the server IP above to exclude it.

Result

24
IPv4 prefixes
1
IPv6 prefixes
99.99%
of IPv4 space tunnelled
AllowedIPs = 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.168.0.0/24, 192.168.2.0/23, 192.168.4.0/22, 192.168.8.0/21, 192.168.16.0/20, 192.168.32.0/19, 192.168.64.0/18, 192.168.128.0/17, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4, 224.0.0.0/3, ::/0
peer.conf
[Peer]
PublicKey = <server public key>
Endpoint = SERVER_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.168.0.0/24, 192.168.2.0/23, 192.168.4.0/22, 192.168.8.0/21, 192.168.16.0/20, 192.168.32.0/19, 192.168.64.0/18, 192.168.128.0/17, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4, 224.0.0.0/3, ::/0
PersistentKeepalive = 25
verify-routes.sh
# What the peer captures, as loaded in the kernel
sudo wg show wg0 allowed-ips

# An excluded address: must NOT use the WireGuard interface
ip route get 192.168.1.10

# A tunnelled address: must use the WireGuard interface
ip route get 1.1.1.1

Split tunneling is precise on a server you control

On your own WireGuard server you decide every range that goes through it, the endpoint address never changes, and excluding it is one line. Contabo's entry VPS includes a public IPv4 address and full root access.

Affiliate link: we may earn a commission, at no extra cost to you. The calculator stays free and does not depend on it.

See the Contabo VPS

Why one exclusion turns into two dozen lines

AllowedIPs does two jobs at once: it is the list of destinations the client sends into the tunnel, and the list of source addresses it accepts back from the peer. Both are written as CIDR blocks, and a CIDR block is always a power-of-two range aligned on its own size. Cutting one /24 out of the whole IPv4 space therefore leaves one block for every bit between /0 and /24: 24 prefixes. That is not a bug in the output, it is the shortest exact answer.

Everything except 192.168.1.0/24, IPv6 still fully tunnelled:

AllowedIPs = 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.168.0.0/24, 192.168.2.0/23, 192.168.4.0/22, 192.168.8.0/21, 192.168.16.0/20, 192.168.32.0/19, 192.168.64.0/18, 192.168.128.0/17, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4, 224.0.0.0/3, ::/0

On Linux, wg-quick already keeps directly connected LAN routes usable in full-tunnel mode, through its suppress_prefixlength 0 rule. An explicit exclusion matters most on Android and iOS, on Windows when you want the kill-switch off for local access, for networks that are not directly connected (a second subnet behind your router), and for public addresses you want to reach outside the VPN, such as a bank that blocks VPN exits.

Ranges people usually exclude

Exclude only what you need: every range you skip is traffic that leaves the tunnel unprotected. These are the standard reserved ranges and the reason to skip each one.

RangeWhat it isExclude it when
192.168.1.0/24A typical home LAN (check yours)You need the printer, NAS or router while connected
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16All RFC 1918 private IPv4You move between networks you do not know in advance
169.254.0.0/16IPv4 link-local (RFC 3927)Self-assigned devices, or the cloud metadata address 169.254.169.254 on a VM
fc00::/7IPv6 unique local (RFC 4193)Your LAN devices also use IPv6 ULA addresses
fe80::/10IPv6 link-local (RFC 4291)Rarely needed: per-interface routes already win
203.0.113.10/32One public address (example)A service that refuses VPN traffic, or the server's own IP on Linux
What split tunneling is, and when it is a risk →Advanced: split tunneling with ip rule and routing tables →CIDR and subnets explained from scratch →

Frequently asked questions

How do I exclude my local network from a WireGuard tunnel?
AllowedIPs has no exclusion syntax, so you list the complement. Put 0.0.0.0/0, ::/0 in the included field and your LAN, for example 192.168.1.0/24, in the excluded field: the calculator returns the CIDR blocks that cover everything else. Paste that line into the [Peer] section of the client config. On Android, the official app has an "Exclude private IPs" checkbox that does the same for private ranges.
Why is the AllowedIPs line so long?
A CIDR block is a power-of-two range aligned on its size, so carving a hole leaves one block per bit of difference. Removing a /24 from 0.0.0.0/0 gives 24 prefixes, removing the three RFC 1918 ranges gives a few more. The list looks long but it is exact and the kernel handles it without measurable cost.
Do I need to exclude the WireGuard server's own IP?
With wg-quick on Linux, yes as soon as your list is not a plain 0.0.0.0/0. wg-quick only applies its endpoint-protecting policy routing to /0 entries; with any other list the routes go into the main table, and if they cover the server's public address the encrypted packets are sent into the tunnel itself. Add the endpoint in the calculator: it is excluded as a single address. Doing it costs nothing on other platforms either.
Does excluding a range disable the kill-switch on Windows?
Yes. WireGuard for Windows only offers "Block untunneled traffic (kill-switch)" when the tunnel has a single peer whose AllowedIPs contain 0.0.0.0/0 or ::/0. A computed list without /0 removes that option. Decide which matters more for that device: local access or a hard block on anything outside the tunnel.
Client or server: where does this AllowedIPs go?
In the [Peer] section of the client, where it decides what the client sends into the tunnel. On the server, each client peer should keep only its own tunnel address, for example 10.66.66.2/32. Two peers on the server must never share a range: WireGuard assigns an address to one peer only, so the last one configured takes it.
Will DNS still go through the tunnel after I exclude my LAN?
Not if your DNS server sits in the excluded range. A router at 192.168.1.1 used as resolver will then be reached outside the tunnel, and every lookup leaves unprotected. Set DNS = in the [Interface] section to an address that stays inside the tunnel, such as the server's tunnel IP or a public resolver that the list still routes.