diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7713192d9..6b0dd1bb8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,8 @@ See for more information about XPrivacy 3 [this FAQ](https://github.com/M66B/XPr
 
 **Next release**
 
+* Strip IP address from IP address / domain name pair for better wildcards ([issue](/../../issues/2014))
+
 [Open issues](https://github.com/M66B/XPrivacy/issues?state=open)
 
 **Version 3.3.3 BETA**
diff --git a/src/biz/bokhorst/xprivacy/PrivacyService.java b/src/biz/bokhorst/xprivacy/PrivacyService.java
index 8b479dc62..54e32c052 100644
--- a/src/biz/bokhorst/xprivacy/PrivacyService.java
+++ b/src/biz/bokhorst/xprivacy/PrivacyService.java
@@ -443,6 +443,13 @@ else if (hook.getFrom() != null) {
 				}
 			}
 
+			// Process IP address
+			if (restriction.extra != null && Meta.cTypeIPAddress.equals(hook.whitelist())) {
+				int slash = restriction.extra.indexOf('/');
+				if (slash >= 0)
+					restriction.extra = restriction.extra.substring(slash + 1);
+			}
+
 			// Check for system component
 			if (!PrivacyManager.isApplication(restriction.uid))
 				if (!getSettingBool(userId, PrivacyManager.cSettingSystem, false))
@@ -1976,13 +1983,6 @@ private String[] getXExtra(PRestriction restriction, Hook hook) {
 				// sub-domain or sub-net
 				int colon = restriction.extra.lastIndexOf(':');
 				String address = (colon >= 0 ? restriction.extra.substring(0, colon) : restriction.extra);
-
-				int slash = address.indexOf('/');
-				if (slash == 0)
-					address = address.substring(slash + 1); // IP address
-				else if (slash > 0)
-					address = address.substring(0, slash); // domain name
-
 				if (Patterns.IP_ADDRESS.matcher(address).matches()) {
 					int dot = address.lastIndexOf('.');
 					listResult.add(address.substring(0, dot) + ".*"