NS8 and practical routing and firewall rules

Yes, it’s identical. Every wireguard peer can set allowed ips but for example the client can not set the servers allowedips. The server setting “AllowedIPs” sets up the clients routing table so if set to 0.0.0.0/24 all traffic goes over wireguard and is then routed to the local network. If you just define the host 192.168.0.10/32 in “Allowed IPs” then just that host is reachable.

Wg-easy aims to be a simple-to-use wireguard solution so I don’t think this will be possible in the new version, maybe we need something like GitHub - DefGuard/defguard: Zero-Trust access management with true WireGuard® 2FA/MFA as already recommended by @oneitonitram here