I'm slightly confused. What the author seems to be saying (although he doesn't state it quite so directly) is that even if you specify "Endpoint = ip:port" in t

I'm slightly confused. What the author seems to be saying (although he doesn't state it quite so directly) is that even if you specify "Endpoint = ip:port" in the configuration, that Wireguard will update that if it receives a correctly authenticated packet from a different IP address. At first, I thought this sounded like a bug, but actually reading the documentation [1] it's clearly as-designed. It's referred to as "initial configuration" (their italics) and then explains how it updates. I see there's an official mailing list for wireguard. Perhaps he should suggest a new feature there to disable that roaming functionality. [1] https://www.wireguard.com/ https://www.wireguard.com/ in the "Built-in Roaming" section