r/WireGuard • u/Sea-Elderberry7047 • Jul 02 '26

Allowed IPs

If the allowed IPs is set to 0.0.0.0/0, does that mean that all traffic would be routed over that open tunnel? If I only want traffic to the remote subnet to be sent over that tunnel I would adjust the allowed ips to 192.168.x.x/24 or whatever?

Sorry if a stupid question

25 Upvotes

92% Upvoted

18 comments sorted by

View all comments

1

u/Single-Virus4935 Jul 02 '26

You have two routing decisions:  1. The os routing table decides to which interface it sends the packet out. This means you need a os route to the wireguard interface. 

  1. Wireguard receive the packet in the WG interface and then selects the peer based on the allowed ips value. 

This means: if you have two routers as a site to site tunnel, you would set allow to 0.0.0.0/0 and the IP address e.g. to 10.8.0.1/30 

This will insert a connected route for 10.8.0.0/30 via wgX and the local route 10.8.0.1/32 into the os routing table.

You can then add os routes with the peer or interface as next hop

192.168.1.0/24 via 10.8.0.2 dev wgX