Let’s say I’ve got a WireGuard interface (configured with wg-quick) “wg0″ for which a “100.100.100.100” peer with “0.0.0.0/0” allowed-ips is defined.
How does traffic for 100.100.100.100 happen to find its way while all other traffic goes through the “wg0” interface?
There is nothing related to 100.100.100.100 in the route rules or routing tables, and “ip route get 100.100.100.100” returns something like:

100.100.100.100 dev wg0 table 100500 src 10.0.0.2

So all the traffic for the peer must be sent through the tunnel, but it obviously goes through the default routes. Why?

The actual reason why I’m digging into this is that I need to add exclusions to the peers’ routing. For the “regular” default routes, it can be done by adding more specific routing rules or routing rules with lower metrics, but with WireGuard everything appears to be different.