A failsafe method is to create a vlan with a gateway that is the VPN. Using Linux routing tables, the vlan device routes to the wgX as the gateway. If the VPN

A failsafe method is to create a vlan with a gateway that is the VPN. Using Linux routing tables, the vlan device routes to the wgX as the gateway. If the VPN app dies, there isn't a route to the internet for hosts on the vlan. As far as IPv6 is concerned, there is no entry in the routing tables so IPv6 packets can't leave the network.