Warning: AllowedIP has nonzero host part

Warning: AllowedIP has nonzero host part

TL;DR: your AllowedIPs line has host bits set outside the network mask, for example CONTAINERIP/24. WireGuard warns and may route oddly. Change it to the network address (CONTAINERIP/24) or use a /32 when you mean a single host.

Warning: AllowedIP has nonzero host part

Steps

1. Open the interface config:

sudo nano /etc/wireguard/wg0.conf

2. Find the offending line, something like:

AllowedIPs = CONTAINER_IP/24

Change it to the network address:

AllowedIPs = CONTAINER_IP/24

Or, if you meant exactly one host:

AllowedIPs = CONTAINER_IP/32

3. Re-apply:

sudo wg-quick down wg0 && sudo wg-quick up wg0

Expected: the interface comes up with no warning, and wg show displays the peer.

When this applies

• the warning appears on wg-quick up
• traffic to some hosts in the range behaves strangely
• configs copied from examples with a host address left in a /24

When it doesnt

• RTNETLINK answers: File exists — an address conflict, not a mask issue
• handshake never completes — that is keys or endpoints, not this
• you intentionally want the whole subnet — then use the .0/24 form

Compatibility

wireguard-tools on Linux, any peer config with AllowedIPs.

Other phrasings

• wg-quick warns nonzero host part
• AllowedIPs host bits set

Why it happens

A /24 network address must have the last octet zeroed. CONTAINERIP/24 describes host .5 inside network CONTAINERIP/24, so the kernel-facing route is ambiguous and WireGuard flags it.

Edge cases

• the all-interfaces address/0 (full tunnel) never triggers this; only masked ranges with stray host bits do.
• Both sides should agree on the intended range or return traffic may take a different path.