WireGuard AllowedIPs: routing and peer filtering explained

AllowedIPs in a [Peer] section does two jobs at once. For outgoing packets it acts as a routing table: traffic to those addresses goes to that peer. For incoming packets it acts as a filter: packets from that peer are accepted only if their source address is in the list. WireGuard calls this cryptokey routing.

Typical configurations

Example client config

[Interface]
PrivateKey = <client-private-key>
Address = 10.8.0.2/32
DNS = 10.8.0.1

[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.com:51820
AllowedIPs = 10.8.0.0/24, 192.168.10.0/24
PersistentKeepalive = 25

wg-quick up wg0 creates routes for every AllowedIPs entry. With 0.0.0.0/0 it also installs policy routing so the encrypted traffic to the endpoint does not loop through the tunnel.

Pitfalls

• Two peers on one interface must not have overlapping AllowedIPs; the most specific match wins and the other peer stops receiving that traffic.
• On the server, use a /32 (IPv4) or /128 (IPv6) per client; a wider range lets that client spoof other addresses.
• Check what is applied with wg show wg0 allowed-ips.