IIUC the way the server (Graphana/Minecraft) and the proxy described in the OP interact is the following: All incoming packets pass through the proxy which is r

IIUC the way the server (Graphana/Minecraft) and the proxy described in the OP interact is the following: All incoming packets pass through the proxy which is running WireGuard in user space and which then passes them on to the server (which only listens on 127.0.0.1): > By setting the whitelist setting to 127.0.0.1, you only allow connections from the Grafana authentication proxy to be able to bypass Grafana’s normal authentication mechanisms. Since the proxy runs WireGuard in user space it will take care of assigning the IP addresses itself (after successful authentication), meaning no IP address spoofing or network interface "confusion" is possible.