WireGuard AllowedIPs Calculator

You use the AllowedIPs setting of WireGuard to configure which blocks of IP addresses should be routed through which remote WireGuard peers. If you want to access everything through a peer, configure its AllowedIPs setting to the following:

This indicates to WireGuard that all IPv4 addresses (0.0.0.0/0) and all IPv6 addresses (::/0) should be routed through the peer. Note that you can specify multiple blocks of addresses on the same line, separated by commas, like above; or you can specify them individually on separate lines, like below:

If you want to access just a single block of IP addresses through a WireGuard peer, like say a block of IP addresses at a remote site that range from 192.168.100.0 to 192.168.100.255, you’d set the AllowedIPs for it to the following:

But what if you want the inverse, where you want everything except a single block (or two or three specific blocks) to be routed through a WireGuard peer? In many cases, you have subtract the exceptions from the block of allowed addresses, and set AllowedIPs to the resulting (often long) list of blocks.

For example, say you want to route all Internet traffic through a WireGuard peer, except that you don’t want to route the traffic of your internal networks through it, which use various subnets within the private-use 10.0.0.0/8 block. To make that happen with the AllowedIPs setting, you’d have to configure the peer with the following AllowedIPs:

That’s the list of blocks you get when you subtract 10.0.0.0/8 from 0.0.0.0/0 — conceptually you might express it like the following:

Or another way of expressing it might be:

As you can see, subtracting one block of IP address from another block can result in a painfully long list of blocks to add to the AllowedIPs setting. On some platforms, like mobile phones, you don’t have any other options — but on Linux, you have some powerful routing tools available that can simplify the situation.

In most cases, you can simply add a route to your main routing table to “subtract” a block of IP addresses from those routed via the WireGuard tunnel. And you may even find that the necessary route already exists — in which case you don’t have to do anything at all.

For example, say you want to route everything in the 10.0.0.0/8 block to a WireGuard peer, except for 10.0.1.0/24. Instead of subtracting 10.0.1.0/24 from 10.0.0.0/8 with the above calculator, and setting the peer’s AllowedIPs to the result, just set the peer’s AllowedIPs to the full 10.0.0.0/8 block. Outside of WireGuard, add an explicit route for 10.0.1.0/24 to your main routing table. Because 10.0.1.0/24 has a longer prefix length than 10.0.0.0/8 (/24 vs /8), the Linux routing engine will automatically use the route for 10.0.1.0/24 over the route for 10.0.0.0/8.

In fact, you may find that you have the necessary route for the exceptional block already set up — run the command ip route show table main (or just ip route, which by default lists the routes of your main routing table) on the host to see what (IPv4) routes you have already:

If do you see a route listed for your exceptional block (10.0.1.0/24 in our example), you won’t have to add anything. If you don’t see it listed, however, you’ll have to add the route yourself. Fortunately, this easy — you just need to know the IP address of the gateway for the block, and the network interface to get there. Often, this will be the same as your default gateway (the line beginning with default in the above listing).

The simplest way to do this is to add the following ip route add and ip route del commands to the PreUp and PostDown scripts in your WireGuard config. To add a route for the 10.0.1.0/24 block with 192.168.1.1 as the gateway using the eth0 interface, add the following PreUp and PostDown settings to the [Interface] section of your WireGuard config:

Note that you can have multiple PreUp and PostDown lines in your config (similar to AllowedIPs). Multiple PreUp or PostDown lines are equivalent to a single PreUp or PostDown line joined together by semicolons.

Also note that the ip route commands above apply only to IPv4 addresses — for IPv6 addresses, you have to add the -6 flag (eg ip -6 route show table main).