WireGuard Routing Public IP Gotcha

Mostly a note to self.

When using WireGuard as a backbone between two routers, and doing full IP routing (e.g. 21.12.22.12) across that tunnel... Remember that the AllowedIPs range needs to be 0.0.0.0/0.

This is because if some arbitrary connection comes in (which in this scenario... we want... to serve content...), e.g. 31.13.99.1. Then it would be dropped by the over-restrictive WireGuard policy and crypto routing. If we only allowed an OSPF link or management IP range (e.g. 10.22.11.1), then as soon as that 31.13.99.1 src packet hits the WireGuard tunnel as part of being forwarded along the router chain, the sender drops the packet. It doesn't match the rules.

So, it has to be 0.0.0.0/0 to allow any and all IP addresses to hop across the link.