CIDR exclude

Take a set of CIDR blocks, remove the blocks you don't want, and get the fewest blocks that cover what's left. Built for WireGuard AllowedIPs and firewall rules.

Result

Example: everything except a home network. Type your own lists above.

Blocks34the fewest that cover what's left

IPv4 addresses left4,294,967,040256 removed

IPv6 addresses left≈ 339.9 undecillion2^118 (332.3 decillion) removed

0.0.0.0/1
128.0.0.0/2
192.0.0.0/9
192.128.0.0/11
192.160.0.0/13
192.168.0.0/24
192.168.2.0/23
192.168.4.0/22
192.168.8.0/21
192.168.16.0/20
192.168.32.0/19
192.168.64.0/18
192.168.128.0/17
192.169.0.0/16
192.170.0.0/15
192.172.0.0/14
192.176.0.0/12
192.192.0.0/10
193.0.0.0/8
194.0.0.0/7
196.0.0.0/6
200.0.0.0/5
208.0.0.0/4
224.0.0.0/3
::/1
8000::/2
c000::/3
e000::/4
f000::/5
f800::/6
fc00::/7
fe00::/9
fec0::/10
ff00::/8

WireGuard

AllowedIPs = 0.0.0.0/1, 128.0.0.0/2, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.168.0.0/24, 192.168.2.0/23, 192.168.4.0/22, 192.168.8.0/21, 192.168.16.0/20, 192.168.32.0/19, 192.168.64.0/18, 192.168.128.0/17, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4, 224.0.0.0/3, ::/1, 8000::/2, c000::/3, e000::/4, f000::/5, f800::/6, fc00::/7, fe00::/9, fec0::/10, ff00::/8

Put the line in the [Peer] section of the client's config. Add the WireGuard server's own public address to the exclude list too, so the tunnel's traffic doesn't try to travel through the tunnel.

How it works

Many tools only understand "allow these blocks", not "allow everything except". WireGuard is the common case: its AllowedIPs setting lists the addresses to send through the tunnel. To send all traffic except your local network, you need every block of the internet minus your LAN.

The tool subtracts the exclude list from the include list, then writes what's left as the fewest CIDR blocks. Removing one /24 from 0.0.0.0/0 leaves 24 blocks, one for each bit of the prefix.

The presets remove the private ranges (10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16), loopback, link-local, the carrier NAT range 100.64.0.0/10, multicast and reserved space. For IPv6 they remove unique local (fc00::/7), link-local, multicast and loopback.

To merge a list without removing anything, use the CIDR aggregator. To turn the result into firewall rules, use the allowlist formatter.