On: WireGuard: next generation in-kernel modern VPN

[bulatb]

What happens if a client gets assigned a new IP that isn't in the server's whitelist? How do they connect?

[zx2c4 → bulatb]

Endpoint IPs are learned based on successfully authenticated/decrypted packets. The Endpoint= entry in the config is just the location of an initial server endpoint. Inner tunnel IPs are fixed in the config, and it's up to things that build ontop of WireGuard to manage this however fits best.