make it a toggle option. The iOS wireguard app makes this same scenario pretty simple. But looks like it does the inverse by defining wireguard allowed IPs ¯\_(ツ)_/¯