WG default routing

[Chris Osicki]

On Wed, Jan 06, 2021 at 01:25:30AM +0500, Roman Mamedov wrote:
> On Tue, 5 Jan 2021 21:12:12 +0100
> Chris Osicki <wg at osk.ch> wrote:
> 
> > As far as I can see after few tests, AllowedIPs config file option has nothing to do with routing and I hope 
> > it will stay like this.
> 
> wg-quick uses AllowedIPs to also set up matching entries in the system routing
> table. This can be disabled in its config.
> 
> > It is just a filter
> 
> It is not only a filter on incoming packets, but also WG's internal routing
> table for knowing which packets should be sent to which peer.

I'm sorry to contradict you but after some more readig I have to :-)
WG has no "internal routing table", wg-quick (which, BTW, is not the subject of my query) uses it to modify 
kernel routing tables, from the wg-quick man page:

       It infers all routes from the list of peers' allowed IPs, and automatically adds them to  the  system  routing
       table.  If  one  of  those  routes is the default route (0.0.0.0/0 or ::/0), then it uses ip-rule(8) to handle
       overriding of the default gateway.

So, in my test config I have a server, 10.10.10.1 and two clients, 10.10.10.2/3
If on the server I remove the AllowedIPs option, no one can connect.
Giving AllowedIPs = 10.10.10.0/24 both clients can connect and routing in them stays as it was.
The same for the clients, without AllowedIPs = 10.10.10.0/24 cannot connect.

Thus, my question still remains: why this filtering function?

> 
> -- 
> With respect,
> Roman

Regards,
Chris