What this does
Computes the exact list of CIDR blocks needed to route a base range (by default, all of IPv4 — 0.0.0.0/0) through a VPN while excluding specific subnets — the practical answer to "route everything except my home network", entirely in your browser. The result is ready to paste directly into a WireGuard peer's AllowedIPs or an OpenVPN/route configuration.
Why this needs actual computation
CIDR notation can only express power-of-two-aligned ranges, so "everything except one specific subnet" isn't itself expressible as a single CIDR block — it has to be rebuilt from a set of smaller blocks that fit around the hole. This tool does that bit arithmetic exactly (recursively splitting the base range in half and keeping whichever half doesn't overlap the exclusion), which is the same technique real-world "WireGuard AllowedIPs exclude calculator" tools use, rather than an approximation.
FAQ
Why does excluding one /24 produce so many output lines?
Because CIDR blocks can only represent power-of-two-aligned ranges, "everything except this one subnet" can't be written as a single range — it has to be built from a sequence of same-size-or-larger blocks that fit around the hole. Excluding a /24 from a /0 base takes 24 blocks; excluding it from a /16 base (which is already much smaller) only takes 8. The more specific your base range, the fewer resulting blocks.
Is the output list minimal — could it be shorter?
For a single exclusion, yes — this is the minimal set of CIDR blocks that exactly covers the base range minus the excluded one. For multiple exclusions applied together, the result is exact but not always the theoretical minimum, since blocks split around one exclusion aren't re-merged if a later exclusion happens to leave them adjacent again. In practice this rarely produces a meaningfully longer list than the true minimum.
Can I exclude a subnet that isn't inside my base range?
Yes — it's simply a no-op. An exclusion that doesn't overlap the base range at all leaves the base unchanged in the output, since there's nothing to remove.
What if my exclusions overlap each other?
That's fine — each exclusion is applied in sequence against whatever remains, so overlapping exclusions just narrow the same hole rather than causing an error or double-counting.
Does this work for IPv6?
Not currently — the underlying bit arithmetic is IPv4-specific (32-bit addresses). IPv6's 128-bit address space uses the identical splitting logic in principle, but needs its own implementation to handle the wider integers correctly.
Try it yourself
For the full split-tunnel vs full-tunnel tradeoff, see VPN Split-Tunneling Explained. Building the rest of a WireGuard config? WireGuard Config Validator checks it before you deploy it.