WireGuard AllowedIPs & Config Generator

Compute split-tunnel AllowedIPs CIDR lists that exclude private LAN subnets from 0.0.0.0/0, and generate client/peer WireGuard configuration templates locally.

Subnets to Exclude from Full Tunnel (comma-separated)

Server Endpoint (Host:Port)

Client Tunnel Address

Tunnel DNS Servers

Computed AllowedIPs (0 CIDR Blocks)

Generated WireGuard Peer Configuration

How WireGuard Cryptokey Routing & AllowedIPs Split Tunneling Work

WireGuard replaces complex IPsec security associations with a concise concept called Cryptokey Routing: each peer entry binds a Curve25519 public key directly to a list of allowed IPv4 and IPv6 prefixes (AllowedIPs). On a client device, AllowedIPs simultaneously defines which outbound destination routes enter the encrypted wg0 interface and which source IPs are accepted when decrypting inbound packets.

Setting AllowedIPs = 0.0.0.0/0 routes all IPv4 traffic through the VPN tunnel, which can inadvertently cut off access to local printers, NAS storage, Kubernetes dev clusters, or RFC 1918 corporate LAN gateways. Because standard WireGuard configuration files do not support negative exclusion syntax (such as !192.168.1.0/24), engineers must decompose 0.0.0.0/0 into the minimal set of non-overlapping CIDR prefixes that cover the public internet while omitting local private ranges.

This calculator performs exact binary trie subtraction in your browser—and optionally generates a 256-bit random PresharedKey via the browser's Web Crypto CSPRNG (crypto.getRandomValues) to add post-quantum symmetric resistance without transmitting any secrets over the network.