What is cryptokey routing in WireGuard, and what does AllowedIPs do?
Show the answer
Say this first
Each peer is a public key plus a list of AllowedIPs. For outgoing packets, WireGuard picks the peer whose AllowedIPs best match the destination, like a routing table, and encrypts to that peer. For incoming packets, after decryption it checks that the inner source address is inside the AllowedIPs of the peer that sent it and drops the packet otherwise. So AllowedIPs is both the route and the source filter, and one prefix can belong to only one peer on an interface.
Go deeper
Site-to-site example
| On | Peer | AllowedIPs |
|---|---|---|
| GW1 (LAN 10.1.0.0/24) | GW2 | 172.16.99.2/32, 10.2.0.0/24 |
| GW2 (LAN 10.2.0.0/24) | GW1 | 172.16.99.1/32, 10.1.0.0/24 |
If GW2 forgets 10.1.0.0/24, packets from GW1's LAN arrive, decrypt, and are dropped because their source is not allowed for that peer.
Kernel routing still matters
The kernel decides which interface a packet uses. wg-quick adds routes for each AllowedIPs entry;
with plain ip link add wg0 type wireguard you add them yourself.
Behaviours worth knowing
AllowedIPs = 0.0.0.0/0makes that peer the default for everything, the usual full-tunnel client.- Adding a prefix to one peer removes it from any other peer on the same interface.
- For dynamic routing, a common pattern is one peer per wg interface with 0.0.0.0/0, and BGP or OSPF programming the kernel routes.
They will ask next
A branch host cannot reach HQ over WireGuard although the latest handshake is recent. What do you check?
AllowedIPs on both sides for the LAN prefixes, the kernel routes to the remote LAN via wg0,
net.ipv4.ip_forward=1on both gateways, firewall forward rules, and whether HQ servers route the branch prefix back to the WireGuard gateway.Does a recent handshake prove that traffic flows?
It proves the keys, endpoint and UDP path work. Data can still fail on AllowedIPs, routing, forwarding or firewall rules.
Traps
- Calling AllowedIPs "just an ACL". It also decides which peer an outgoing packet is encrypted to.