In reply to @antifuchs:asf.computer
yeuuuup, looks like [Match] block semantics changed: previously in a .network file I had to match the "old" name (enp*) when now I have to match the renamed name that a preceding .link file effects

In reply to @oddlama:matrix.org
I always had the least amount of pain when I matched hardware interfaces by MACAddress

Well, I made an attempt to go from this:

  networking.wg-quick.interfaces = {
    wg0 = {
      address = [
        "10.0.0.2/24"
        "fdc9:281f:04d7:9ee9::2/64"
      ];
      dns = [
        "10.0.0.1"
        "fdc9:281f:04d7:9ee9::1"
      ];
      privateKeyFile = "/root/wireguard-keys/privatekey";

      peers = [
        {
          publicKey = "key1";
          presharedKeyFile = "/root/wireguard-keys/preshared_from_peer0_key";
          allowedIPs = [
            # only route vpn related services
            #"10.0.0.0/24"
            #"fdc9:281f:04d7:9ee9::/64"
            # send everything and do NAT
            "0.0.0.0/0"
            "::/0"
          ];
          endpoint = "ip1:ip1";
          persistentKeepalive = 25;
        }
      ];
    };
    wg1 = {
      address = [
        "10.0.1.2/24"
        "fdc9:281f:04d7:9eea::2/64"
      ];
      dns = [
        "10.0.1.1"
        "fdc9:281f:04d7:9eea::1"
      ];
      privateKeyFile = "/root/wireguard-keys/privatekey_wg1";

      peers = [
        {
          publicKey = "key2";
          allowedIPs = [
            "10.0.1.0/24"
            "fdc9:281f:04d7:9eea::/64"
          ];
          endpoint = "ip2:port2";
          persistentKeepalive = 25;
        }
      ];
    };
  };

to this:

  networking.useNetworkd = true;
  systemd.network = {
    networks."10-enp5s0" = {
      matchConfig.Name = "enp5s0";
      networkConfig.DHCP = "yes";
    };
    networks."50-wg0" = {
      matchConfig.Name = "wg0";
      address = [
        "fdc9:281f:04d7:9ee9::2/64"
        "10.0.0.2/24"
      ];
      domains = [ "~." ];
      dns = [
        "10.0.0.1"
        "fdc9:281f:04d7:9ee9::1"
      ];
      #networkConfig = {
      #  DNSDefaultRoute = true;
      #};
      routingPolicyRules = [
        {
          Family = "both";
          InvertRule = true;
          FirewallMark = 94;
          Table = 1337;
          Priority = 10;
        }
        {
          To = "ip1/32"; # use /32 for IPv4
          Priority = 5;
        }
      ];
    };
    netdevs."50-wg0" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "wg0";
      };
      wireguardConfig = {
        PrivateKeyFile = "/var/lib/wireguard-keys/privatekey";
        #RouteTable = "main";
        FirewallMark = 94;
      };
      wireguardPeers = [
        {
          PublicKey = "key1";
          PresharedKeyFile = "/var/lib/wireguard-keys/preshared_from_peer0_key";
          AllowedIPs = [
            #"10.0.0.0/24"
            #"fdc9:281f:04d7:9ee9::/64"
            # send everything and do NAT
            "0.0.0.0/0"
            "::/0"
          ];
          RouteTable = 1337;
          Endpoint = "ip1:port1";
          PersistentKeepalive = 25;
        }
      ];
    };
    networks."50-wg1" = {
      matchConfig.Name = "wg1";
      address = [
        "fdc9:281f:04d7:9eea::2/64"
        "10.0.1.2/24"
      ];
      domains = [ "~." ];
      dns = [
        "10.0.1.1"
        "fdc9:281f:04d7:9eea::1"
      ];
    };
    netdevs."50-wg1" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "wg1";
      };
      wireguardConfig = {
        PrivateKeyFile = "/var/lib/wireguard-keys/privatekey_wg1";
        RouteTable = "main";
      };
      wireguardPeers = [
        {
          PublicKey = "key2";
          AllowedIPs = [
            "10.0.1.0/24"
            "fdc9:281f:04d7:9eea::/64"
          ];
          Endpoint = "ip2:port2";
          PersistentKeepalive = 25;
        }
      ];
    };
  };

and it kinda worked.

hey, I'm slowly going insane trying to configure my router to send certain traffic over a wireguard tunnel. As far as I can tell I have the wireguard connection up (I see handshakes and sent / recieved bytes in wg status). I set a route over the tunnel though and no traffic actually makes it across. I'd really appreciate some pointers in how to debug, I've exhausted my realatively limited networking knowledge.

I'm using systemd-networkd, I have a brigde interface (for my lan switch) a wan interface, and a whole bunch of wireguard interfaces and routing across most of the wireguard interfaces work fine, but they are in private subnets. What I'm trying to do with this one is send some traffic to a public IP on the internet over a wireguard interface rather than my default route.