diff --git a/app/src/main/java/com/wireguard/config/Peer.java b/app/src/main/java/com/wireguard/config/Peer.java
index 1d69beb2..35a58499 100644
--- a/app/src/main/java/com/wireguard/config/Peer.java
+++ b/app/src/main/java/com/wireguard/config/Peer.java
@@ -20,6 +20,8 @@ import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.UnknownHostException;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
 
@@ -245,11 +247,40 @@ public class Peer {
             return 0;
         }
 
+        private static final String DEFAULT_ROUTE_V4 = "0.0.0.0/0";
+        private static final List<String> DEFAULT_ROUTE_MOD_RFC1918_V4 = Arrays.asList("0.0.0.0/5", "8.0.0.0/7", "11.0.0.0/8", "12.0.0.0/6", "16.0.0.0/4", "32.0.0.0/3", "64.0.0.0/2", "128.0.0.0/3", "160.0.0.0/5", "168.0.0.0/6", "172.0.0.0/12", "172.32.0.0/11", "172.64.0.0/10", "172.128.0.0/9", "173.0.0.0/8", "174.0.0.0/7", "176.0.0.0/4", "192.0.0.0/9", "192.128.0.0/11", "192.160.0.0/13", "192.169.0.0/16", "192.170.0.0/15", "192.172.0.0/14", "192.176.0.0/12", "192.192.0.0/10", "193.0.0.0/8", "194.0.0.0/7", "196.0.0.0/6", "200.0.0.0/5", "208.0.0.0/4");
+
+        public void toggleExcludePrivateIPs() {
+            final HashSet<String> ips = new HashSet<>(Arrays.asList(Attribute.stringToList(allowedIPs)));
+            final boolean hasDefaultRoute = ips.contains(DEFAULT_ROUTE_V4);
+            final boolean hasDefaultRouteModRFC1918 = ips.containsAll(DEFAULT_ROUTE_MOD_RFC1918_V4);
+            if (hasDefaultRoute && hasDefaultRouteModRFC1918)
+                ips.removeAll(DEFAULT_ROUTE_MOD_RFC1918_V4);
+            else if (hasDefaultRoute) {
+                ips.remove(DEFAULT_ROUTE_V4);
+                ips.addAll(DEFAULT_ROUTE_MOD_RFC1918_V4);
+            } else if (hasDefaultRouteModRFC1918) {
+                ips.removeAll(DEFAULT_ROUTE_MOD_RFC1918_V4);
+                ips.add(DEFAULT_ROUTE_V4);
+            }
+            setAllowedIPs(Attribute.iterableToString(ips));
+        }
+
         @Bindable
         public String getAllowedIPs() {
             return allowedIPs;
         }
 
+        @Bindable
+        public boolean getAllowedIPsContainsDefaultRoute() {
+            return Arrays.asList(Attribute.stringToList(allowedIPs)).contains(DEFAULT_ROUTE_V4);
+        }
+
+        @Bindable
+        public boolean getAllowedIPsContainsDefaultRouteModRFC1918() {
+            return Arrays.asList(Attribute.stringToList(allowedIPs)).containsAll(DEFAULT_ROUTE_MOD_RFC1918_V4);
+        }
+
         @Bindable
         public String getEndpoint() {
             return endpoint;
@@ -281,6 +312,8 @@ public class Peer {
         public void setAllowedIPs(final String allowedIPs) {
             this.allowedIPs = allowedIPs;
             notifyPropertyChanged(BR.allowedIPs);
+            notifyPropertyChanged(BR.allowedIPsContainsDefaultRoute);
+            notifyPropertyChanged(BR.allowedIPsContainsDefaultRouteModRFC1918);
         }
 
         public void setEndpoint(final String endpoint) {
diff --git a/app/src/main/res/layout/tunnel_editor_peer.xml b/app/src/main/res/layout/tunnel_editor_peer.xml
index 309ef7bb..5a84fd92 100644
--- a/app/src/main/res/layout/tunnel_editor_peer.xml
+++ b/app/src/main/res/layout/tunnel_editor_peer.xml
@@ -4,6 +4,7 @@
 
     <data>
 
+        <import type="android.view.View"/>
         <import type="com.wireguard.android.widget.KeyInputFilter" />
 
         <variable
@@ -103,12 +104,22 @@
                 android:inputType="textNoSuggestions|textVisiblePassword"
                 android:text="@={item.allowedIPs}" />
 
+            <CheckBox
+                android:id="@+id/exclude_private_ips"
+                android:layout_width="wrap_content"
+                android:layout_height="wrap_content"
+                android:layout_below="@+id/allowed_ips_text"
+                android:visibility="@{(item.allowedIPsContainsDefaultRoute || item.allowedIPsContainsDefaultRouteModRFC1918) ? View.VISIBLE : View.GONE}"
+                android:checked="@{item.allowedIPsContainsDefaultRouteModRFC1918}"
+                android:onClick="@{() -> item.toggleExcludePrivateIPs()}"
+                android:text="@string/exclude_private_ips" />
+
             <TextView
                 android:id="@+id/endpoint_label"
                 android:layout_width="wrap_content"
                 android:layout_height="wrap_content"
                 android:layout_alignParentStart="true"
-                android:layout_below="@+id/allowed_ips_text"
+                android:layout_below="@+id/exclude_private_ips"
                 android:layout_toStartOf="@+id/persistent_keepalive_label"
                 android:labelFor="@+id/endpoint_text"
                 android:text="@string/endpoint" />
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index b44e3121..b4105d2d 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -43,6 +43,7 @@
     <string name="error_root">Please obtain root access and try again</string>
     <string name="error_up">Error bringing up tunnel: %s</string>
     <string name="excluded_applications">Excluded Applications</string>
+    <string name="exclude_private_ips">Exclude Private IPs</string>
     <string name="generate">Generate</string>
     <string name="hint_automatic">(auto)</string>
     <string name="hint_generated">(generated)</string>