Every WireGuard peer answers one question: which destination addresses belong in the tunnel. Get AllowedIPs wrong and traffic either leaks around the tunnel or vanishes into the wrong one, usually without a single error message. This calculator handles the three parts of that job.
1. Split tunnel: cut networks out of a range
Enter the range the tunnel should carry and the networks that must stay outside it. The result is the smallest possible set of CIDR blocks covering everything that is left, ready to paste behind AllowedIPs.
2. Overlaps between peers
Paste the AllowedIPs of each peer, one peer per line: a name, a colon, then the networks separated by commas.
3. Tunnel MTU
The tunnel wraps every packet in extra headers. Set the tunnel MTU too high and packets get fragmented or silently dropped, which usually shows up as pages that load halfway and then stall.