WireGuard’s philosophy seems to follow the unix “do one thing and do it well”. So for dynamic routing, 2FA, config management etc you are expected to use other

WireGuard’s philosophy seems to follow the unix “do one thing and do it well”. So for dynamic routing, 2FA, config management etc you are expected to use other tools for that. Ie for dynamic routing you should be running BGP or OSPF over the tunnel. I don’t particularly like this approach, definitely prefer how OpenVPN handles both routing updates (subnet push) and 2FA, despite its other flaws (slower, especially).