Allowed IPs field rejects entries without a CIDR suffix, contrary to its own tooltip

[Akuseru7]

Summary

The tooltip for the "Allowed IPs" field describes the accepted input as "A comma-separated list of IP addresses or CIDR ranges that are allowed for communication through the tunnel."

An entry without a CIDR suffix is rejected with "Field is invalid". This applies to any entry in the field, whether it is the only one or one of several comma-separated entries, and regardless of its position in the list.

Steps to reproduce

1. Manually import or configure a tunnel in the Desktop Client
2. In "Allowed IPs", enter a plain IP address with no CIDR suffix, e.g. 172.16.0.1. This applies to any entry: removing the suffix from any of several comma-separated entries produces the same result, regardless of position.
3. Try to save
4. "Field is invalid" is shown and the config cannot be saved
5. Append a CIDR suffix, e.g. 172.16.0.1/24, and the config saves
6. Connect to the location. On Windows the connection fails with:
   Failed to configure WireGuard interface : CreateIpForwardEntry2: Falscher Parameter. (os error 87)
   ("Falscher Parameter" is "The parameter is incorrect" on a German Windows locale)

Expected behavior

A plain IP address without a CIDR suffix is accepted, as stated in the tooltip.

Actual behavior

Standard WireGuard (wg-quick) treats an address without a suffix as /32 (/128 for IPv6), so the same convention could apply here, independently of other entries in the same field that do carry an explicit suffix.

If a suffix is in fact required, the tooltip currently does not reflect that.

os error 87 is ERROR_INVALID_PARAMETER. I have not verified what exactly is passed to CreateIpForwardEntry2 internally.

Defguard version

Desktop Client v1.6.9 (no Defguard server involved, connecting to a plain WireGuard server)

Environment details

Windows 11 25H2 (Build 26200.8875)

Deployment / install method

Standalone packages

Relevant logs / output

[6.8.2026, 23:09:20][INFO][VPN] Stopping statistics collector task for interface <interfacename>
[6.8.2026, 23:09:20][INFO][VPN] Interface <interfacename> removed successfully
[6.8.2026, 23:23:49][INFO][Client] The tunnel <tunnelname>(ID: 1) configuration has been updated.
[6.8.2026, 23:23:52][ERROR][VPN] wireguard: Failed to find matching adapter name: Element nicht gefunden. (Code 0x00000490)
[6.8.2026, 23:23:52][INFO][VPN] wireguard: Using existing driver 0.10
[6.8.2026, 23:23:52][INFO][VPN] wireguard: Creating adapter
[6.8.2026, 23:23:52][INFO][VPN] Opened/created interface <interfacename>
[6.8.2026, 23:23:52][INFO][VPN] Done creating a new interface <interfacename>
[6.8.2026, 23:23:52][INFO][VPN] endpoint: <redacted>
[6.8.2026, 23:23:52][ERROR][VPN] Failed to configure WireGuard interface <interfacename>: CreateIpForwardEntry2: Falscher Parameter. (os error 87)
[6.8.2026, 23:23:52][ERROR][VPN] Failed to configure interface <interfacename>. Error: code: 'Internal error', message: "Failed to configure WireGuard interface <interfacename>: CreateIpForwardEntry2: Falscher Parameter. (os error 87)"
[6.8.2026, 23:23:52][INFO][VPN] Interface <interfacename> removed successfully
[6.8.2026, 23:23:52][ERROR][Client] Failed to create a network interface (<interfacename>) for tunnel <tunnelname>(ID: 1): code: 'Internal error', message: "Failed to configure WireGuard interface <interfacename>: CreateIpForwardEntry2: Falscher Parameter. (os error 87)"
[6.8.2026, 23:23:52][ERROR][Client] Invoking "connect" failed due to unknown error: "Internal error: Failed to create a network interface (<interfacename>) for tunnel <tunnelname>(ID: 1), error message: Failed to configure WireGuard interface <interfacename>: CreateIpForwardEntry2: Falscher Parameter. (os error 87). Check logs for more details."
[6.8.2026, 23:23:52][ERROR][Client] Error handling interface for location 1 (connect): Invoking "connect" failed due to unknown error: "Internal error: Failed to create a network interface (<interfacename>) for tunnel <tunnelname>(ID: 1), error message: Failed to configure WireGuard interface <interfacename>: CreateIpForwardEntry2: Falscher Parameter. (os error 87). Check logs for more details."

Relevant configuration (redacted)

AllowedIPs = 172.16.0.1/24, 10.0.0.0/24, 10.0.1.0/24

(addresses replaced with examples, structure preserved. Removing the suffix from any of the three entries results in "Field is invalid", regardless of position.)