Stop WireGuard from clobbering your main routing table with PeerAllowedIPs

Technical Briefing | 8/11/2026

You set up a WireGuard interface, bring it up with wg-quick, and suddenly your default gateway settings get completely overridden. It is a classic behavior that catches everyone off guard the first time. The tool tries to be helpful by automatically pushing routes into your main table based on the AllowedIPs directive, but that often breaks split-tunneling or creates asymmetrical routing messes that are a nightmare to debug.

Why the automatic route injection is fighting you

The wg-quick script executes ip route commands for every entry in your AllowedIPs list. If you define 0.0.0.0/0, it assumes you want all traffic going through the tunnel. If you just wanted a peer-to-peer connection for a specific subnet, the implicit route creation is exactly what you don’t need. I have seen this silently kill production traffic when a VPN peer decides it owns the entire address space and the kernel just listens.

Table = off
PostUp = ip route add 10.0.5.0/24 dev wg0
PreDown = ip route del 10.0.5.0/24 dev wg0

• Set Table = off in the Interface section to stop the automatic route injection entirely
• Use PostUp and PreDown hooks to manually define only the routes you actually want
• Check your ip rule list to ensure wireguard-injected routing tables aren’t shadowing your main traffic

By disabling the automatic table management, you reclaim control over the routing logic. You stop fighting the wrapper script and start configuring the stack yourself. Next time your interface comes up, run ip route show table main to confirm nothing unexpected has appeared. You will sleep better knowing the routing table looks exactly the way you intended.