Adding exceptions is the "right" way to do it. I believe you can wildcard them as well, so you could add exceptions for 10.*.*.*, 192.168.*.*, and 172.16.*.*, which covers most RFC1918 compliant networks that you'd ever run into. Then you'd just have to add exceptions for any public-facing addresses. It will be interesting to see what happens once Java 8 comes out.