@feld What I suspect happens is that Wireguard drops your packets silently (this is by design), if they aren't in the AllowedIPs list for that specific peer.
You should be able to that happen, if you run this and watch dmesg
echo module wireguard +p > /sys/kernel/debug/dynamic_debug/controlI might also be completely misinterpreting your setup.