This specifically (CPU exhaustion attack) is called out as a rationale for why Wireguard implements cookie reply packets[1]. If a verified source is DOSing you

This specifically (CPU exhaustion attack) is called out as a rationale for why Wireguard implements cookie reply packets[1]. If a verified source is DOSing you with bad handshakes, maybe its time for their IP to be put in timeout in an upstream routing table. [1] https://www.wireguard.com/protocol/#dos-mitigation https://www.wireguard.com/protocol/#dos-mitigation