/flags/wireguard/wg-set-allowed-ips-incremental
wg set allowed-ips +10.0.5.0/24: add or remove one route without replacing the list
- tool
- WireGuard
- command
- wg set
- flag
- peer KEY allowed-ips [+|-]IP/CIDR,...
- default
- without + or -, the given list replaces the peer's allowed IPs
sudo wg set wg0 peer 'PEER_PUBLIC_KEY=' allowed-ips +10.0.5.0/24 adds one network to a peer's AllowedIPs on the running interface and keeps the existing entries. The wg(8) manual explains that by default allowed-ips replaces a peer's allowed IPs, and that if + or - is prepended to any of the IPs, the update is incremental: entries with + (or no prefix in an incremental list) are added if not present, entries with - are removed if present. Without the prefix, allowed-ips 10.0.5.0/24 would silently drop every other network routed to that peer.
Commands
sudo wg show wg0 allowed-ips # current lists per peer
sudo wg set wg0 peer 'PEER_PUBLIC_KEY=' allowed-ips +10.0.5.0/24 # add one network
sudo wg set wg0 peer 'PEER_PUBLIC_KEY=' allowed-ips -10.0.4.0/24 # remove one network
sudo wg set wg0 peer 'PEER_PUBLIC_KEY=' allowed-ips +10.0.6.0/24,-10.0.5.0/24 # both at once
sudo wg set wg0 peer 'PEER_PUBLIC_KEY=' allowed-ips 10.0.0.2/32 # replace the whole listReplace versus incremental
| Value | Effect |
|---|---|
| 10.0.0.2/32,10.0.5.0/24 | The list becomes exactly these two entries |
| +10.0.5.0/24 | Adds the entry, keeps the rest |
| -10.0.5.0/24 | Removes the entry, keeps the rest |
| '' (empty string) | Removes all allowed IPs from the peer |
What AllowedIPs does
AllowedIPs is WireGuard's cryptokey routing table: for outgoing packets it decides which peer a destination belongs to, and for incoming packets it lists the source addresses accepted from that peer. An address range can belong to only one peer on an interface, so adding a range to one peer removes it from another that had it. The concept and common mistakes are explained in WireGuard AllowedIPs.
Pitfalls
- Kernel routes are separate. wg-quick creates routes for AllowedIPs at
up; runtime changes withwg setneed a matchingip route add ... dev wg0(andip route delwhen removing). - Older wireguard-tools. The
+/-syntax is newer than the original tool; on old releases a prefixed entry is rejected, so checkwg --versionon long-term-support systems. - Persist the change. Update
AllowedIPsin the configuration file or runwg-quick save wg0; otherwise the next restart restores the old list. - Check the result with
wg show wg0 allowed-ipsor wg show dump; adding complete peers is covered in add a peer without restarting.
FAQ
Why did wg set allowed-ips remove my other subnets?
By default allowed-ips replaces the peer's whole list. Prefix each entry with + to add it or - to remove it, which the wg(8) manual describes as an incremental update.
Does wg set allowed-ips also add the route?
No. wg only changes WireGuard's cryptokey routing table. wg-quick adds kernel routes for AllowedIPs when the interface comes up; after a runtime change you add the route yourself, for example with ip route add 10.0.5.0/24 dev wg0.
How do I remove all allowed IPs of a peer?
Pass an empty string: wg set wg0 peer KEY allowed-ips ''. The manual states that all allowed IPs are then removed from the peer.