diff --git a/fsn1/systemd-networkd/dn42i1.netdev b/fsn1/systemd-networkd/dn42i1.netdev
index 99d1896..0221954 100644
--- a/fsn1/systemd-networkd/dn42i1.netdev
+++ b/fsn1/systemd-networkd/dn42i1.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/private.key
 [WireGuardPeer]
 PublicKey = PlMza8PC6N58vpGqMsBo3UjvjXThl/2WCTK6drjqbgY=
 Endpoint = nbg1.dn42.zotan.network:40001
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10
diff --git a/fsn1/systemd-networkd/dn42i2.netdev b/fsn1/systemd-networkd/dn42i2.netdev
index 5089bed..0403c75 100644
--- a/fsn1/systemd-networkd/dn42i2.netdev
+++ b/fsn1/systemd-networkd/dn42i2.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/private.key
 [WireGuardPeer]
 PublicKey = B+3QYRU5UqaWYAsKMfyk7wqDzsFZ31RluCakeXEVm2E=
 Endpoint = hel1.dn42.zotan.network:40001
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10
diff --git a/fsn1/systemd-networkd/dn42p1.netdev b/fsn1/systemd-networkd/dn42p1.netdev
index 0a930f8..21770ed 100644
--- a/fsn1/systemd-networkd/dn42p1.netdev
+++ b/fsn1/systemd-networkd/dn42p1.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/graffen.key
 [WireGuardPeer]
 PublicKey = qChjUaGN7D44d+3KJk4liFQvm8EQuKGYXlCMOYQhLx8=
 Endpoint = dn42-de-fsn1.hessnet.dk:22341
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10
diff --git a/fsn1/systemd-networkd/dn42p2.netdev b/fsn1/systemd-networkd/dn42p2.netdev
index d62741c..ba20db3 100644
--- a/fsn1/systemd-networkd/dn42p2.netdev
+++ b/fsn1/systemd-networkd/dn42p2.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/manawyrm.key
 [WireGuardPeer]
 PublicKey = z4drftGk8vvWwTfCCMJYjWWzHP7bCJSvlMpEbEkFI2U=
 Endpoint = dn42.tbspace.de:49035
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10
diff --git a/fsn1/systemd-networkd/dn42p3.netdev b/fsn1/systemd-networkd/dn42p3.netdev
index 660db3d..2748cca 100644
--- a/fsn1/systemd-networkd/dn42p3.netdev
+++ b/fsn1/systemd-networkd/dn42p3.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/private.key
 [WireGuardPeer]
 PublicKey = ttIiOeCZw9pFD9HATXK7T3eOGViJEgNolAsiXJdPgjc=
 Endpoint = ch-zrh01.dn42.munsternet.eu:51846
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10
diff --git a/fsn1/systemd-networkd/dn42p4.netdev b/fsn1/systemd-networkd/dn42p4.netdev
index c2b347a..997e952 100644
--- a/fsn1/systemd-networkd/dn42p4.netdev
+++ b/fsn1/systemd-networkd/dn42p4.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/private.key
 [WireGuardPeer]
 PublicKey = aD4W4RrdiAlq9mZQQ459cq1nmcGW4k9A6GnopZbnxXE=
 Endpoint = dn42-de-fra1.burble.com:22341
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10
diff --git a/hel1/systemd-networkd/dn42i1.netdev b/hel1/systemd-networkd/dn42i1.netdev
index 9c26c33..00329a8 100644
--- a/hel1/systemd-networkd/dn42i1.netdev
+++ b/hel1/systemd-networkd/dn42i1.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/private.key
 [WireGuardPeer]
 PublicKey = F3gqp7BZaIXgVjB1KM4ausbAgO0jnwlZwuUtEgj0RRo=
 Endpoint = fsn1.dn42.zotan.network:40002
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10
diff --git a/hel1/systemd-networkd/dn42i2.netdev b/hel1/systemd-networkd/dn42i2.netdev
index 1c4a790..7c391fa 100644
--- a/hel1/systemd-networkd/dn42i2.netdev
+++ b/hel1/systemd-networkd/dn42i2.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/private.key
 [WireGuardPeer]
 PublicKey = PlMza8PC6N58vpGqMsBo3UjvjXThl/2WCTK6drjqbgY=
 Endpoint = nbg1.dn42.zotan.network:40002
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10
diff --git a/nbg1/systemd-networkd/dn42i1.netdev b/nbg1/systemd-networkd/dn42i1.netdev
index 6311e0c..746b765 100644
--- a/nbg1/systemd-networkd/dn42i1.netdev
+++ b/nbg1/systemd-networkd/dn42i1.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/private.key
 [WireGuardPeer]
 PublicKey = F3gqp7BZaIXgVjB1KM4ausbAgO0jnwlZwuUtEgj0RRo=
 Endpoint = fsn1.dn42.zotan.network:40001
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10
diff --git a/nbg1/systemd-networkd/dn42i2.netdev b/nbg1/systemd-networkd/dn42i2.netdev
index 0842f83..aa13208 100644
--- a/nbg1/systemd-networkd/dn42i2.netdev
+++ b/nbg1/systemd-networkd/dn42i2.netdev
@@ -10,4 +10,4 @@ PrivateKeyFile = /etc/wireguard/private.key
 [WireGuardPeer]
 PublicKey = B+3QYRU5UqaWYAsKMfyk7wqDzsFZ31RluCakeXEVm2E=
 Endpoint = hel1.dn42.zotan.network:40002
-AllowedIPs = 0.0.0.0/0,::/0
+AllowedIPs = 172.16.0.0/12,10.0.0.0/8,fd00::/8,fe80::/10