wireguard - ? - puzzle

Hi guys. Has anybody solved that puzzle? Or perhaps it's not a puzzle at all, I'd imagine might be trivial to experts. First I thought - and only thought so far thus asking here - 'allowed_address_pairs' I'd need but that obviously does not do anything as 'wireguard' creates its own ifaces. So.. how do you get your 'wireguard' in openstack to route (no NAT) to instances' local network(s)? many thanks, L.