I have three machines hooked together: A desktop, a laptop, and small public server. The desktop and laptop are usually on NAT-ed networks, while the server has a static IP with publicly accessible ports. By only specifying the server ( on both machines, they are able to connect to ping each other ( and, respectively) through it. However, I want the laptop and desktop to connect directly over LAN on the occasion they are both on the same LAN, for obvious performance reasons.

I have already tried putting down an additional Peer entry on the laptop and desktop informing them about the other using their fixed private IPs when on the LAN. This prevents the general rule from ever taking effect, though.

How can I get the laptop and desktop to connect using a direct connection specified via Endpoint when accessible, but fallback to a more general server otherwise?


The small public server will be functioning as a "Bounce Server"

According to the "How Wireguard Routes Packets" section of "Some Unofficial WireGuard Documentation", setting up a specific route directly to the host (e.g., and a more general route (e.g. should allow the hosts to connect directly to each other, and fallback to routing through the bounce server:

More specific (also usually more direct) routes provided by other peers will take precedence when available, otherwise traffic will fall back to the least specific route

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.