Hi Cong, I'm not so sure this makes sense, as the inner packet is in fact totally different. If you want to distinguish the ingress interface, can't you just use `iptables -i wg0` or `ip rule add ... iif wg0`? Jason