` for the endpoint allows the default route to work as intended. Now both the `networking.wireguard.interfaces` and manual `wg-quick` work as intended.
---
### Author:  [@Kranzes](https://discourse.nixos.org/u/Kranzes)
#### Post date: [January 8, 2021, 11:07pm UTC](https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577/5 "2021-01-08T23:07:42Z")
“this only works for a static network setup and fails if gateways or devices change (e.g. using ethernet or wifi on a laptop).”
---
### Author:  [@chrissound](https://discourse.nixos.org/u/chrissound)
#### Post date: [March 7, 2021, 12:04pm UTC](https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577/6 "2021-03-07T12:04:22Z")
Hmm potentially seem to be running into the same issue.
What does `endpoint ip` and `gateway` get set to? I’ve tried the public ip of the wireguard server, and the ‘usual’ gateway ip with seemingly no change in behavior.
Strangely if I set `allowed_ips` to a set of ips that is not `0.0.0.0`, then it works correctly.
---
### Author:  [@supermarin](https://discourse.nixos.org/u/supermarin)
#### Post date: [April 5, 2022, 3:16am UTC](https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577/7 "2022-04-05T03:16:43Z")
Same here. The `ip route add` way doesn’t make sense for a non-static IP setup, like on a laptop. Haven’t figured out how to resolve this yet
---
### Author:  [@leana8959](https://discourse.nixos.org/u/leana8959)
#### Post date: [January 1, 2024, 9:02pm UTC](https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577/8 "2024-01-01T21:02:17Z")
Hello, I would like to set up wireguard on my computer, are there new methods to do this without creating an `ip route` ? Thanks 🙂
Update: I noticed that I don’t actually need to set up an ip route for this, it wouldn’t work before due to another misconfiguration. Have a great day 🙂
---
### Author:  [@Salvage-This](https://discourse.nixos.org/u/Salvage-This)
#### Post date: [November 21, 2024, 5:37pm UTC](https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577/9 "2024-11-21T17:37:30Z")
Sorry for bumping such an old thread, but some relevant documentation still seems to link here. Adding a fix here for those that want it.
I added this script that will auto detect the endpoint, gateway and network device used in your default route and adds a route that will fix the connection issues using the fix described in [https://wiki.archlinux.org/title/WireGuard#Loop\_routing](https://wiki.archlinux.org/title/WireGuard#Loop_routing)
It has one dependency in wg (installed with [wireguard-tools](https://search.nixos.org/packages?channel=24.05&show=wireguard-tools&from=0&size=50&sort=relevance&type=packages&query=wireguard-tools)) and the script also assumes you are using a wireguard interface named wg0. Be sure to update to match your settings.
one troubleshooting note, you will need to activate your wireguard connection first before attempting to run the script. Running it before activating the connection will result in a failure to find the wireguard interface.
```bash
# Setup the basics
ENDPOINT_IP=$(wg show wg0 endpoints | awk '{print $2}' | cut -d':' -f1)
DEFAULT_ROUTE=$(ip route | grep default)
GW="$(echo $DEFAULT_ROUTE | cut -d ' ' -f3)"
DEV="$(echo $DEFAULT_ROUTE | cut -d ' ' -f5)"
# Check if there are other routes to be removed
if [[$(ip route | grep $ENDPOINT_IP)]]; then
echo "route exists, removing..."
ip route delete $(ip route | grep $ENDPOINT_IP)
fi
# Setup a new route
echo "Adding a new route for active connection...
executing -> ip route add $ENDPOINT_IP via $GW dev $DEV"
ip route add $ENDPOINT_IP via $GW dev $DEV
```
---
### Author:  [@nrbray](https://discourse.nixos.org/u/nrbray)
#### Post date: [October 29, 2025, 4:15pm UTC](https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577/10 "2025-10-29T16:15:37Z")
> [@Salvage-This](#):
>
> `DEFAULT_ROUTE=$(ip route | grep default)`
This I changed to
`DEFAULT_ROUTE=$(ip route | grep 'default via')`
and that worked for me, else it picked up the first (instead of the wanted) of two default entries:
```auto
# ip route | grep default
default dev wg1 scope link
default via 192.168.8.1 dev wlp4s0 proto dhcp src 192.168.8.115 metric 3002
```