What's new

Wireguard Selective Routing - Cannot isolate to a single client

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!


Occasional Visitor
Hey @ZebMcKayhan,

Following your guidance on the other thread, I managed to successfully import my known-working Wireguard config:

nano /opt/etc/wireguard.d/aws-wg.conf
import aws-wg.conf

Got a message "[: missing ]" but showed import as successful.

I don't want this peer to start automatically, so I set it to auto=n

peer wg11 auto=n

I then configure the selective routing rule:

peer wg11 rule add vpn comment VPNTest

Seems to go through fine, and returns "Updated RPDB Selective Routing rule for wg11"

However, when I start wg11, it successfully connects, but all my LAN devices are going out via the VPN, rather than just the one at


- Am I understanding the use of Auto=n correctly? Is that preventing wg11 automatically establishing a connection? That's what I want - to be able to manually turn on/off the client via an IOS Shortcut and not have wg11 connected all the time. I wasn't sure if Auto=P turns on an auto connect. I tested with Auto=P, and the policy did just apply to the single device,, however, I don't want wg11 to always auto-connect.
- A workaround appears to be to leave Auto=N, and use wgm start wg11 policy which forces wg11 to run in policy mode. This seems to solve my problem, but wanted to check that's the direction I should be going in.

Last edited:

Similar threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!