Or: how I almost locked myself out of my own EC2 box, and the guard that fixed it.
I needed one process on a box in us-east-1 to egress through a WireGuard peer in a different geographic location. Everything else on the host had to keep behaving normally: SSH from my laptop, SSM from the AWS console, the package manager, the metrics agent. The host was fine where it was. Only this one workload needed a different exit.
The obvious move is wg-quick up on the host with your provider's config. Don't do that. WireGuard's default AllowedIPs = 0.0.0.0/0 rewrites the host's main routing table, which means every outbound packet now goes through the tunnel, including the SSH session you're typing into. If the tunnel doesn't fully come up, or if the peer can't reach you back on the new path, you've just dropped yourself off the network. On a VM with no serial console enabled, you're calling support.
So the actual question is: how do you scope a tunnel to a single process and guarantee the host's networking is untouched?
The wrong answer: policy routing
