Why AllowedIPs needs calculating
In WireGuard, AllowedIPs decides which traffic goes into the tunnel. 0.0.0.0/0 sends everything, and you lose your printer, NAS and router on the LAN. WireGuard has no “except”, so “everything but 192.168.0.0/16” must be written as the set of subnets covering the rest. The calculator does that and keeps the list as short as possible.
Common mistakes
- The Endpoint inside AllowedIPs on a router: the tunnel tries to go through itself and drops. Exclude the server IP. The Windows, macOS, Android and iOS apps handle this themselves.
- The config’s DNS server outside the tunnel: with DNS = 10.8.0.1 that subnet must be in AllowedIPs.
- IPv4 only while IPv6 works: IPv6 sites bypass the tunnel. Keep ::/0 or disable IPv6 on the client.
A complete server and client config: WireGuard config generator. Service lists in other formats: service IP ranges. Tunnel MTU: MTU calculator.