# Warning: AllowedIP has nonzero host part

TL;DR: your AllowedIPs line has host bits set outside the network mask, for example CONTAINER_IP/24. WireGuard warns and may route oddly. Change it to the network address (CONTAINER_IP/24) or use a /32 when you mean a single host.

```text
Warning: AllowedIP has nonzero host part
```

## Steps

1. Open the interface config:

```bash
sudo nano /etc/wireguard/wg0.conf
```

2. Find the offending line, something like:

```text
AllowedIPs = CONTAINER_IP/24
```

Change it to the network address:

```text
AllowedIPs = CONTAINER_IP/24
```

Or, if you meant exactly one host:

```text
AllowedIPs = CONTAINER_IP/32
```

3. Re-apply:

```bash
sudo wg-quick down wg0 && sudo wg-quick up wg0
```

Expected: the interface comes up with no warning, and `wg show` displays the peer.

## When this applies

- the warning appears on `wg-quick up`
- traffic to some hosts in the range behaves strangely
- configs copied from examples with a host address left in a /24

## When it doesnt

- `RTNETLINK answers: File exists` — an address conflict, not a mask issue
- handshake never completes — that is keys or endpoints, not this
- you intentionally want the whole subnet — then use the .0/24 form

## Compatibility

wireguard-tools on Linux, any peer config with AllowedIPs.

## Other phrasings

- `wg-quick warns nonzero host part`
- `AllowedIPs host bits set`

## Why it happens

A /24 network address must have the last octet zeroed. CONTAINER_IP/24 describes host .5 inside network CONTAINER_IP/24, so the kernel-facing route is ambiguous and WireGuard flags it.

## Edge cases

- the all-interfaces address/0 (full tunnel) never triggers this; only masked ranges with stray host bits do.
- Both sides should agree on the intended range or return traffic may take a different path.