But the FW can’t filter by source IP and key, which is important to some people. There’s a gap in security coverage between WG and FW. This is commonly supporte

But the FW can’t filter by source IP and key, which is important to some people. There’s a gap in security coverage between WG and FW. This is commonly supported by IPsec implementations already. Remember your WG service could be terminating many tunnels from many different sources. Some yes roaming may be valid. Others not. There is no way in WG to selectively disable roaming for some keys but not others. This may be an intentional design decision in WG but I would argue it’s a poor one due to the above.