WireGuard enforces a very strict mapping between public keys and IP addresses, so you can't have two public keys with the same internal tunnelled IP address ("A

WireGuard enforces a very strict mapping between public keys and IP addresses, so you can't have two public keys with the same internal tunnelled IP address ("AllowedIPs"). This way you can have rules like "if it comes from the WireGuard interface and it's from 10.8.3.9, then it must be from public key ABCD," which make firewalling and ACLs and the general security posture a lot more straightforward. In your case, it sounds like you want to change the AllowedIPs from one peer to the other based on some kind of metric you have for determining disruption. In this case, you can do that switch at runtime: $ wg set wg0 peer ABCD allowed-ips 0.0.0.0/0 or $ wg set wg0 peer EFG9 allowed-ips 0.0.0.0/0 Alternatively, if you wish to determine this disruption situation using traditional routing daemons, that set actual routes, as opposed to WireGuard AllowedIPs, then you could just have two separate WireGuard interfaces, and leave it to your routing daemon to decide which one to use.