Policy-based routing

Bruno bruno at streamfeed.com
Fri Mar 9 20:38:35 CET 2018


I'm trying to set up a policy-based routing on a wireguard instance. I 
didn't want to call it server, because it acts more like a proxy.

Let's say I have 6 peers plus this wireguard server.

Peer 2  Peer 3   Peer 4
  \/       \/       \/
|                     |
| Wireguard "server"  |
|                     |
  \/       \/       \/
Peer 5  Peer 6   Peer 7

Wireguard "server"
Address =

Peers 2-7
Address =, respectively.

So, what I'm trying to do is route traffic to Peer 7, for example, if it 
is coming from Peer 2. I can do it doing some `ip rule` and `ip route` 
commands. However, wireguard seems to be blocking that traffic. So, I 
want peers 5-7 act as gateways to the internet and I would choose it via 
Linux environment.

Peers 5-7 would be wireguard servers that would route all traffic to the 
internet. So, on the wireguard instance (, "server"), I have 
to set allowed IPs to peers 5-7 as "", correct? Does wireguard 
accept that? On my tests it would just pick one as allowed IPs as and set others to (none). Then, I couldn't reach traffic 
neither from nor to that others peers.

On the wireguard "server" I would set allowed-IPs to peers 2-4 as as I don't need traffic going through it, just 
coming from it.

Is it possible to achieve that with wireguard?


More information about the WireGuard mailing list