{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/wireguard-allowedips-send-receive-review/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/",
        "slug": "wireguard-allowedips-send-receive-review",
        "url": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/wireguard-allowedips-send-receive-review/"
        },
        "title": "Review both directions of a WireGuard AllowedIPs change",
        "summary": "Treat AllowedIPs as both peer selection for outgoing traffic and source validation for incoming traffic.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T00:43:27+00:00",
        "modified_at": "2026-10-15T00:44:33+00:00",
        "reviewed_on": "2026-10-14",
        "reading_minutes": 2,
        "word_count": 253,
        "potentially_affected": "Use this guide when changing a peer’s AllowedIPs or diagnosing one-way tunnel traffic. Check the peer configuration and the operating-system route table as separate parts of the review.",
        "dse_recommendation": "DSE recommends documenting the intended destination networks and permitted incoming source networks for each peer before editing the list.",
        "primary_source": {
            "name": "WireGuard — Conceptual Overview and Cryptokey Routing",
            "url": "https://www.wireguard.com/",
            "published_on": null,
            "authority": "www.wireguard.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Treat AllowedIPs as both peer selection for outgoing traffic and source validation for incoming traffic.</p>\n<h2>Source facts</h2>\n<p>WireGuard’s conceptual overview explains that each peer’s public key is associated with allowed tunnel addresses. On transmission, the packet’s destination selects the peer. On reception, the decrypted packet’s source address must be permitted for the authenticated peer or it is dropped. WireGuard exposes a network interface whose addresses and operating-system routes are configured through the platform’s networking tools.</p>\n<p>Source: <a href=\"https://www.wireguard.com/\">WireGuard — Conceptual Overview and Cryptokey Routing</a>.</p>\n<h2>Applicability</h2>\n<p>Use this guide when changing a peer’s AllowedIPs or diagnosing one-way tunnel traffic. Check the peer configuration and the operating-system route table as separate parts of the review.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends documenting the intended destination networks and permitted incoming source networks for each peer before editing the list. Avoid widening prefixes merely to make a failed test pass. Compare the proposed entry on both ends with interface addressing, routes, forwarding, and application access policy. Keep private keys out of the change record; identify peers using approved public identifiers. Preserve the prior peer configuration so an unexpected route change can be reversed.</p>\n<h2>Verification</h2>\n<p>Test an authorized destination and inspect the source address seen after decryption. Include a controlled negative test for an unauthorized source in a lab where practical. Confirm the intended route and application access after reconnecting. Record both sending and receiving observations instead of using a recent handshake alone as completion evidence.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://www.wireguard.com/\">WireGuard — Conceptual Overview and Cryptokey Routing</a>. Reviewed October 14, 2026.</p>",
        "content_text": "Treat AllowedIPs as both peer selection for outgoing traffic and source validation for incoming traffic.\nSource facts\nWireGuard’s conceptual overview explains that each peer’s public key is associated with allowed tunnel addresses. On transmission, the packet’s destination selects the peer. On reception, the decrypted packet’s source address must be permitted for the authenticated peer or it is dropped. WireGuard exposes a network interface whose addresses and operating-system routes are configured through the platform’s networking tools.\nSource: WireGuard — Conceptual Overview and Cryptokey Routing.\nApplicability\nUse this guide when changing a peer’s AllowedIPs or diagnosing one-way tunnel traffic. Check the peer configuration and the operating-system route table as separate parts of the review.\nDSE recommendation\nDSE recommends documenting the intended destination networks and permitted incoming source networks for each peer before editing the list. Avoid widening prefixes merely to make a failed test pass. Compare the proposed entry on both ends with interface addressing, routes, forwarding, and application access policy. Keep private keys out of the change record; identify peers using approved public identifiers. Preserve the prior peer configuration so an unexpected route change can be reversed.\nVerification\nTest an authorized destination and inspect the source address seen after decryption. Include a controlled negative test for an unauthorized source in a lab where practical. Confirm the intended route and application access after reconnecting. Record both sending and receiving observations instead of using a recent handshake alone as completion evidence.\nOfficial reference\nWireGuard — Conceptual Overview and Cryptokey Routing. Reviewed October 14, 2026.",
        "content_markdown": "Treat AllowedIPs as both peer selection for outgoing traffic and source validation for incoming traffic.\n\n## Source facts\n\nWireGuard’s conceptual overview explains that each peer’s public key is associated with allowed tunnel addresses. On transmission, the packet’s destination selects the peer. On reception, the decrypted packet’s source address must be permitted for the authenticated peer or it is dropped. WireGuard exposes a network interface whose addresses and operating-system routes are configured through the platform’s networking tools.\n\nSource: [WireGuard — Conceptual Overview and Cryptokey Routing](https://www.wireguard.com/).\n\n## Applicability\n\nUse this guide when changing a peer’s AllowedIPs or diagnosing one-way tunnel traffic. Check the peer configuration and the operating-system route table as separate parts of the review.\n\n## DSE recommendation\n\nDSE recommends documenting the intended destination networks and permitted incoming source networks for each peer before editing the list. Avoid widening prefixes merely to make a failed test pass. Compare the proposed entry on both ends with interface addressing, routes, forwarding, and application access policy. Keep private keys out of the change record; identify peers using approved public identifiers. Preserve the prior peer configuration so an unexpected route change can be reversed.\n\n## Verification\n\nTest an authorized destination and inspect the source address seen after decryption. Include a controlled negative test for an unauthorized source in a lab where practical. Confirm the intended route and application access after reconnecting. Record both sending and receiving observations instead of using a recent handshake alone as completion evidence.\n\n## Official reference\n\n[WireGuard — Conceptual Overview and Cryptokey Routing](https://www.wireguard.com/). Reviewed October 14, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/",
                "url": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-14"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Review both directions of a WireGuard AllowedIPs change",
                        "item": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/#article",
                "identifier": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/",
                "url": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/",
                "headline": "Review both directions of a WireGuard AllowedIPs change",
                "description": "Treat AllowedIPs as both peer selection for outgoing traffic and source validation for incoming traffic.",
                "abstract": "Treat AllowedIPs as both peer selection for outgoing traffic and source validation for incoming traffic.",
                "articleBody": "Treat AllowedIPs as both peer selection for outgoing traffic and source validation for incoming traffic.\nSource facts\nWireGuard’s conceptual overview explains that each peer’s public key is associated with allowed tunnel addresses. On transmission, the packet’s destination selects the peer. On reception, the decrypted packet’s source address must be permitted for the authenticated peer or it is dropped. WireGuard exposes a network interface whose addresses and operating-system routes are configured through the platform’s networking tools.\nSource: WireGuard — Conceptual Overview and Cryptokey Routing.\nApplicability\nUse this guide when changing a peer’s AllowedIPs or diagnosing one-way tunnel traffic. Check the peer configuration and the operating-system route table as separate parts of the review.\nDSE recommendation\nDSE recommends documenting the intended destination networks and permitted incoming source networks for each peer before editing the list. Avoid widening prefixes merely to make a failed test pass. Compare the proposed entry on both ends with interface addressing, routes, forwarding, and application access policy. Keep private keys out of the change record; identify peers using approved public identifiers. Preserve the prior peer configuration so an unexpected route change can be reversed.\nVerification\nTest an authorized destination and inspect the source address seen after decryption. Include a controlled negative test for an unauthorized source in a lab where practical. Confirm the intended route and application access after reconnecting. Record both sending and receiving observations instead of using a recent handshake alone as completion evidence.\nOfficial reference\nWireGuard — Conceptual Overview and Cryptokey Routing. Reviewed October 14, 2026.",
                "datePublished": "2026-10-15T00:43:27+00:00",
                "dateModified": "2026-10-15T00:44:33+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/wireguard-allowedips-send-receive-review/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Review both directions of a WireGuard AllowedIPs change"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 253,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "WireGuard — Conceptual Overview and Cryptokey Routing",
                    "url": "https://www.wireguard.com/"
                }
            }
        ]
    }
}