Linux doesn’t mitigate it out of the box, but you can do this: https://www.wireguard.com/netns/#the-new-namespace-solution