diff --git a/config/config.go b/config/config.go
index ed07086da389b3b323f3723101bfaa8460e010f0..ee8afab92bd28bc788b7e4fce1ceede362be5d1b 100644
--- a/config/config.go
+++ b/config/config.go
@@ -3,9 +3,11 @@
 import (
 	"fmt"
 	"log"
+	"net"
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 
 	"git.sr.ht/~sircmpwn/getopt"
 	"github.com/vaughan0/go-ini"
@@ -14,8 +16,9 @@ 	"git.sr.ht/~sircmpwn/core-go/crypto"
 )
 
 var (
-	Debug bool
-	Addr  string
+	Debug         bool
+	Addr          string
+	InternalIPNet []net.IPNet
 )
 
 // Just loads the config files
@@ -79,6 +82,19 @@ 	}
 
 	config := LoadFiles()
 	crypto.InitCrypto(config)
+
+	nets, ok := config.Get("sr.ht", "internal-ipnet")
+	if !ok {
+		nets = "127.0.0.0/8,192.168.0.0/16,10.0.0.0/8,::1/128,fc00::/7"
+	}
+	for _, n := range strings.Split(nets, ",") {
+		_, net, err := net.ParseCIDR(n)
+		if err != nil {
+			panic(fmt.Errorf("[sr.ht]internal-ipnet: %w", err))
+		}
+		InternalIPNet = append(InternalIPNet, *net)
+	}
+
 	return config
 }
 
@@ -110,3 +126,14 @@ 		}
 	}
 	return value
 }
+
+// Returns true if the given IP address is part of the internal networks as
+// per the configuration of [sr.ht]internal-ipnet.
+func IsInternalIP(ip net.IP) bool {
+	for _, net := range InternalIPNet {
+		if net.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}