![](/static/253f0d9b/assets/icons/icon-96x96.png)
![](https://lemmy.world/pictrs/image/8286e071-7449-4413-a084-1eb5242e2cf4.png)
Iirc setting AllowedIPs in your clients config should do exactly that. Their respective [Peer] entry in your servers config should also have the same AllowedIPs, otherwise they could easily circumvent this
Further finetuning should be really easy by using any firewall on your Wireguard server
If you want your clients to be able to access other devices in your servers LAN you need to setup additional packet forwarding rules though. Optionally setup NAT aswell
No, AllowedIPs should be set to your internal Wireguards IP range to only allow access to your Wireguard peers. You could also add more like your Servers LAN for example (which will need packet forwarding, as I mentioned before)
Here’s an example of one of my client configs:
[Interface] Address = 10.8.0.2/32 PrivateKey = [Peer] PublicKey = PresharedKey = Endpoint = 192.168.0.3:51820 AllowedIPs = 10.8.0.0/16
Just be careful to not mess up your subnet masks. For example my [Interface] Address ends with /32 because that only leaves 10.8.0.2 In the [Peer] Section i set it to /16 which will allow the client to connect to 10.8.x.x iirc
Best is to just try it yourself and see if it works, I’m by no means good at networking stuff