WireGuard AllowedIPs & Split-Tunnel Calculator

Every WireGuard peer answers one question: which destination addresses belong in the tunnel. Get AllowedIPs wrong and traffic either leaks around the tunnel or vanishes into the wrong one, usually without a single error message. This calculator handles the three parts of that job.

1. Split tunnel: cut networks out of a range

Enter the range the tunnel should carry and the networks that must stay outside it. The result is the smallest possible set of CIDR blocks covering everything that is left, ready to paste behind AllowedIPs.

Calculate AllowedIPs

---

2. Overlaps between peers

Paste the AllowedIPs of each peer, one peer per line: a name, a colon, then the networks separated by commas.

Peers and their AllowedIPs office: 10.0.0.0/8, 192.168.1.0/24 home: 192.168.0.0/16 cloud: 172.16.0.0/12, 10.10.0.0/16 backup: 203.0.113.0/24 Check for overlaps

---

3. Tunnel MTU

The tunnel wraps every packet in extra headers. Set the tunnel MTU too high and packets get fragmented or silently dropped, which usually shows up as pages that load halfway and then stall.