Stop the routing table from ignoring your WireGuard peer choices

Technical Briefing | 11/15/2026

WireGuard is usually simple enough that you can just wing it, but the moment you start dealing with multiple peers in a mesh or specific routing requirements, things get weird. Most people assume the AllowedIPs directive magically handles all traffic direction. It doesn’t. It only tells the kernel which packets are allowed to travel through the tunnel. If your main routing table has a more specific path to the destination, your traffic will bypass the tunnel entirely without a single error message. I’ve spent hours hunting this down because I thought the handshake failed, when in reality, the packets were just taking the default gateway route instead of the peer interface.

Why the route lookup ignores your interface

The kernel looks at the destination IP and checks your main routing table before it cares about your WireGuard configuration. If you have a route covering the target address outside the tunnel, that route wins. You need to use policy-based routing to force traffic through the interface. You can set up a routing table specifically for WireGuard and use a firewall mark to shunt traffic into it. This approach is cleaner than trying to manage a hundred static routes by hand, and it’s far more resilient when peers reconnect or IP addresses shift.

ip rule add fwmark 0xCAFE table 200
ip route add default dev wg0 table 200
nft add rule inet filter output meta mark 0xCAFE accept

• Create a dedicated routing table in /etc/iproute2/rt_tables
• Tag specific traffic in nftables with a mark using the meta mark expression
• Use ip rule to link the firewall mark to your custom routing table

Make sure you keep your mark consistent across your firewall rules. If you change your nftables rules later, that mark is the only thing linking your traffic to the WireGuard table, so don’t lose track of it. This isn’t the most elegant setup, but it beats staring at tcpdump logs for an entire afternoon wondering why your packets are vanishing into the default gateway.