diff --git a/bypass/bypass.go b/bypass/bypass.go
index 2d1781b5..a2709d19 100644
--- a/bypass/bypass.go
+++ b/bypass/bypass.go
@@ -271,8 +271,8 @@ func (bp *localBypass) matched(addr string) bool {
 		host = addr
 	}
 
-	if ip := net.ParseIP(host); ip != nil {
-		return bp.cidrMatcher.Match(host)
+	if ip := net.ParseIP(host); ip != nil && bp.cidrMatcher.Match(host) {
+		return true
 	}
 
 	return bp.wildcardMatcher.Match(addr)