Stop WireGuard from leaking your traffic when the handshake fails

Technical Briefing | 10/29/2026

You probably set up WireGuard because it is fast and simple, but the simplicity hides a nasty surprise. If your interface goes down or the peer stops responding, the kernel might decide your default route is the only way out. That means traffic that was meant to be encrypted suddenly hits your ISP gateway in the clear. I have seen this happen during a routine provider maintenance window, and it is a nightmare to explain to a security auditor.

Why the route table is lying to you

WireGuard interfaces are clever, but they don’t block traffic by default when the tunnel isn’t established. The routing table thinks it is doing the right thing by sending packets toward the tunnel endpoint, but the packet just falls out the wire instead. To fix this, you have to stop relying on the route table alone and force the firewall to act as a fail-safe. If the tunnel is down, the packets shouldn’t leave the buffer.

nft add chain inet filter output { type filter hook output priority 0 ; }
nft add rule inet filter output oifname wg0 accept
nft add rule inet filter output meta oifname != lo drop

• Binding your output chain to the specific interface is the only way to kill leakage
• Make sure your loopback traffic is explicitly allowed or your local services will hang
• Test this by bringing the interface down while pinging an external IP

Most people just set up the wg-quick config and call it a day. That works until your connection flickers. Once you have the ruleset in place, you do not have to worry about the race condition between the interface dropping and the routing daemon reacting. Next time you deploy a tunnel, just stick this policy in your firewall config before you even bring the interface up.