vpn
- AllowedIPs is not access control
A per-friend WireGuard kit scoped each peer with AllowedIPs, which is a route on the friend's own device. The real scope is a forward-chain drop on the router.
- The iPhone camera wanted to Google my private key
Adding WireGuard to a MikroTik: the hairpin test that fails for no reason, and the iPhone Camera app offering to web-search a private key.