On Linux, use network namespaces https://www.wireguard.com/netns/ https://www.wireguard.com/netns/ . Create a separate VPN namespace and have wgN be the only no

On Linux, use network namespaces https://www.wireguard.com/netns/ https://www.wireguard.com/netns/ . Create a separate VPN namespace and have wgN be the only non-loopback interface there, then run your application in that namespace. This also solves WebRTC-style leaks. Physical isolation is even better (e.g. using a spare Raspberry Pi).