On 2026-09-11, Alex Holst <[email protected]> wrote: > Hey all. Am I misunderstanding wg(4): > > The interface will route outbound tunneled traffic to the peer > configured with the most specific matching allowed IP address > range, or drop it if no such match exists. > > Traffic between my laptop and vpn remote works, but I don't see any route > changes at all when I specify remote ranges in wgaip. I can only get traffic > correctly flowing if I manually add an identical list of !route add in > hostname.wg* > > wgpeer $peer \ > wgendpoint 10.10.63.136 51820 \ > wgaip 192.168.101.0/24 \ > wgaip 192.168.62.181/32 \ > wgaip 192.168.62.182/32 \ > wgaip 192.168.62.183/32 \ > wgaip 192.168.62.184/32 \ > wgdescr "vpn01" wgpka 25 > inet 192.168.101.20/24 > !route add -host 192.168.62.181 192.168.101.1 > !route add -host 192.168.62.182 192.168.101.1 > !route add -host 192.168.62.183 192.168.101.1 > !route add -host 192.168.62.184 192.168.101.1 > > Am I doing something wrong? I am surprised that wgaip doesn't automatically > change the routing table when I bring wireguard interfaces up and down. > > I appreciate any hints.
wgaip provides a separate wg-specific "pseudo routing table" that directs traffic to whichever tunnel endpoint is needed depending on the IP, but you separately need an entry in the standard routing table to get the traffic to hit the wg interface in the first place. it's much more flexible if you add that route table entry yourself (with whatever priority, routing table, etc, that you need) than if it was to be added automatically. -- Please keep replies on the mailing list.
