What it means
A packet came through the tunnel from an address that is not in that peer’s AllowedIPs on this side, so WireGuard dropped it.
Why it happens
- The client’s tunnel address differs from what the server lists for it (10.0.0.7 vs 10.0.0.2/32).
- Site-to-site: the remote LAN is not in AllowedIPs of the peer.
- Two peers share an address.
How to fix it
- On the server put exactly the client’s address in [Peer] AllowedIPs (10.0.0.7/32).
- For a network behind the peer add that subnet too (AllowedIPs = 10.0.0.7/32, 192.168.50.0/24).
- Use the AllowedIPs calculator to build the list.
Useful tools
AllowedIPs calculator · WireGuard config generator
Other WireGuard errors
- Handshake for peer 1 (203.0.113.10:51820) did not complete after 5 seconds, retrying (try
- RTNETLINK answers: Operation not supported / Unable to access interface: Protocol not supp
- /usr/bin/wg-quick: line 32: resolvconf: command not found
- Key is not the correct length or format: `abc…`
- Unable to modify interface: Address already in use
- Name or service not known: `vpn.example.com:51820' / Configuration parsing error