Problem
Setting AllowedIPs = 0.0.0.0/0 on a WireGuard client silently hijacked the default route and killed Tailscale connectivity.
Investigation
When a WireGuard peer uses AllowedIPs = 0.0.0.0/0, the kernel routes ALL traffic through the tunnel, including the traffic needed to reach Tailscale's coordination servers. This effectively breaks the Tailscale mesh.
Fix
Use split-tunnel routing so only the mesh subnet is routed through WireGuard:
[Peer]
AllowedIPs = 10.10.0.0/24This keeps the default route and Tailscale untouched while still reaching the mesh.
Lesson
Never use AllowedIPs = 0.0.0.0/0 unless you explicitly want a full tunnel. For a hub-and-spoke mesh, always scope AllowedIPs to the specific subnet.