wireguard-subnet-subtract.py

#!/usr/bin/env python3

# Credit: /u/sellibitze
# https://www.reddit.com/r/WireGuard/comments/emjgp0/bypass_certain_ip_from_going_into_wireguard_tunnel/fdqjr9w/

from ipaddress import ip_network

start = '0.0.0.0/0'
exclude = ['8.8.8.8', '10.8.0.0/24']

result = [ip_network(start)]
for x in exclude:
    n = ip_network(x)
    new = []
    for y in result:
        if y.overlaps(n):
            new.extend(y.address_exclude(n))
        else:
            new.append(y)
    result = new

print(','.join(str(x) for x in sorted(result)))