I have 10.28.0.0/16 setup as a main network for administrators and I created a second network inside that of 10.28.100.0/24 and make that have an ingress gateway. If I generate a conf for an external client inside 10.28.100.0/24 network that works perfectly giving the external client an expected 10.28.100.x ip. However, that external client can simply edit their .conf in wireguard to /16 instead of /24 and have access to the all of 10.28.0.0/16 — how can I prevent that from happening ?

other option is to run iptables (or nftables) commands directly on the ingress host.

I think the rules would be whole lot easier if you created two networks without overlapping ranges. Give admininstrators access to both networks and extclients to only one. if the ingress node is only on the non-admin network, no firewall rules would be required.

What would an example post up/down syntax be to allow only the “allowed IPs” set when generating the confit so even if the client edits them, the original ones are enforced ? Very much appreciate your help!