Stop WireGuard from leaking packets during interface reloads

Technical Briefing | 9/23/2026

You set up a WireGuard interface, apply the config, and everything looks golden. Then you rotate your keys or tweak a peer setting. As soon as you bring the interface down and back up, your traffic leaks out the default gateway for those few milliseconds the interface is missing. This bit me in prod once when a backup script decided to initiate a massive transfer exactly while I was swapping keys.

Why relying on interface state is a losing game

The kernel doesn’t care that your WireGuard config is temporary or being reloaded. If the route exists in the table and the interface vanishes, the kernel simply fails over to the next best route—usually your primary ISP interface. If you are handling sensitive traffic, you cannot rely on the mere existence of the interface as a firewall boundary.

nft add chain inet filter output { type filter hook output priority filter; policy accept; } && nft add rule inet filter output oifname wg0 accept && nft add rule inet filter output meta oifname != wg0 ip daddr 10.0.0.0/24 drop

• Use output filtering that drops packets to your destination range if they aren’t marked for the wg0 interface
• Keep the firewall rules active even when the wg0 interface is deleted
• Ensure your routing table doesn’t have a backup path that bypasses the encrypted tunnel

Locking it down for real

The right approach is to treat the firewall as the authority, not the interface status. By dropping traffic destined for your private subnet unless it specifically hits the tunnel interface, you create a black hole. When the interface reloads, those packets hit the drop rule instead of leaking onto the open wire. It’s a simple shift in mindset that turns an intermittent security vulnerability into a hard guarantee.

Check your nftables ruleset with nft list ruleset after you toggle the interface. If you see the traffic flowing through your default gateway while the interface is down, you know exactly where the leak is happening.