I prefer the namespace approach with wg, as it becomes explicit and easier to use with services through JoinsNamespace. The routing inside the namespace is just

I prefer the namespace approach with wg, as it becomes explicit and easier to use with services through JoinsNamespace. The routing inside the namespace is just using the main table. This also allows to isolate the DNS queries by bind-mounting nsswitch.conf and resolv.conf as well as manage the isolated firewall for the namespace.