@Data @p ran into this problem myself in earlier days of weird networking adventures. i was only able to get things to work without a leak by setting to wg interfaces (v4+v6) then dealing with the respective route tables and nftables rules. disabling ipv6 is about the only thing that makes sense since imho i doubt we will ever see adoption greater than 30% of the internet (i pulled that figure out of my cornhole)