Okay that makes sense, thanks for the info. I'm new to Windows networking and thought WireguardNT was somehow using a WFP callout to encrypt plus reroute packets and then drop the original. Keep up the great work you're doing!