diff --git a/wgengine/wgcfg/parser.go b/wgengine/wgcfg/parser.go
index 55dc95012..f1637ac14 100644
--- a/wgengine/wgcfg/parser.go
+++ b/wgengine/wgcfg/parser.go
@@ -175,7 +175,7 @@ func (cfg *Config) handlePeerLine(peer *Peer, key, value string, valueBytes []by
 		if value != "1" {
 			return fmt.Errorf("invalid protocol version: %v", value)
 		}
-	case "preshared_key", "last_handshake_time_sec", "last_handshake_time_nsec", "tx_bytes", "rx_bytes":
+	case "replace_allowed_ips", "preshared_key", "last_handshake_time_sec", "last_handshake_time_nsec", "tx_bytes", "rx_bytes":
 		// ignore
 	default:
 		return fmt.Errorf("unexpected IpcGetOperation key: %v", key)
diff --git a/wgengine/wgcfg/parser_test.go b/wgengine/wgcfg/parser_test.go
index e101a3a05..46b3bea72 100644
--- a/wgengine/wgcfg/parser_test.go
+++ b/wgengine/wgcfg/parser_test.go
@@ -5,9 +5,14 @@
 package wgcfg
 
 import (
+	"bufio"
+	"bytes"
 	"reflect"
 	"runtime"
 	"testing"
+
+	"inet.af/netaddr"
+	"tailscale.com/types/wgkey"
 )
 
 func noError(t *testing.T, err error) bool {
@@ -53,3 +58,42 @@ func TestParseEndpoint(t *testing.T) {
 		t.Error("Error was expected")
 	}
 }
+
+func BenchmarkFromUAPI(b *testing.B) {
+	newPrivateKey := func() (wgkey.Key, wgkey.Private) {
+		b.Helper()
+		pk, err := wgkey.NewPrivate()
+		if err != nil {
+			b.Fatal(err)
+		}
+		return wgkey.Key(pk.Public()), wgkey.Private(pk)
+	}
+	k1, pk1 := newPrivateKey()
+	ip1 := netaddr.MustParseIPPrefix("10.0.0.1/32")
+
+	peer := Peer{
+		PublicKey:  k1,
+		AllowedIPs: []netaddr.IPPrefix{ip1},
+		Endpoints:  Endpoints{PublicKey: k1},
+	}
+	cfg1 := &Config{
+		PrivateKey: wgkey.Private(pk1),
+		Peers:      []Peer{peer, peer, peer, peer},
+	}
+
+	buf := new(bytes.Buffer)
+	w := bufio.NewWriter(buf)
+	if err := cfg1.ToUAPI(w, &Config{}); err != nil {
+		b.Fatal(err)
+	}
+	w.Flush()
+	r := bytes.NewReader(buf.Bytes())
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		_, err := FromUAPI(r)
+		if err != nil {
+			b.Errorf("failed from UAPI: %v", err)
+		}
+		r.Seek(0, 0)
+	}
+}