diff --git a/protocol/tailscale/endpoint.go b/protocol/tailscale/endpoint.go
index eb22f678..32c00d47 100644
--- a/protocol/tailscale/endpoint.go
+++ b/protocol/tailscale/endpoint.go
@@ -834,6 +834,9 @@ func (t *Endpoint) onReconfig(cfg *wgcfg.Config, routerCfg *router.Config, dnsCf
 	var builder netipx.IPSetBuilder
 	for _, peer := range cfg.Peers {
 		for _, allowedIP := range peer.AllowedIPs {
+			if allowedIP.Bits() == 0 {
+				continue
+			}
 			builder.AddPrefix(allowedIP)
 		}
 	}