wireguard-vpn/docs/superpowers/plans/2026-04-29-allowedips-parsing-plan.md

Update WireGuard Policy Sync to Use AllowedIPs for Target Parsing Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Modify wg-sync-policy.sh to extract access targets from a peer's AllowedIPs list instead of using #Access comments.

Architecture: The AWK script inside wg-sync-policy.sh currently reads the first IP of AllowedIPs as the client IP and looks for an #Access line for targets. We will change the AWK script to read the first IP as the client IP, and any subsequent IPs in the comma-separated AllowedIPs list as the access targets. We will remove the parsing of #Access entirely.

Tech Stack: Bash, AWK, jq

---

Task 1: Update wg-sync-policy.sh AWK Parsing

Files:

• Modify: D:\www-project\wireguard-vpn\03.wireguard-policy\wg-sync-policy.sh

• Step 1: Modify the AWK parsing logic Change the awk script in wg-sync-policy.sh to extract the rest of the IPs from AllowedIPs instead of reading #Access.

# In D:\www-project\wireguard-vpn\03.wireguard-policy\wg-sync-policy.sh, find the awk block (around line 46):

    awk '
    BEGIN { RS="\n\\[Peer\\]\n"; FS="\n" }
    NR>1 {
        ip=""; access=""
        for(i=1;i<=NF;i++){
            if($i ~ /^AllowedIPs/) {
                split($i,a," = ")
                gsub(/ /,"",a[2])
                split(a[2],b,",")
                
                # First IP is the client IP (strip CIDR for ip output if needed, but the original kept it and stripped it later or just kept the IP)
                split(b[1],c,"/")
                ip=c[1]
                
                # The rest of the IPs are access targets
                access_arr=""
                for(j=2;j<=length(b);j++) {
                    if(access_arr=="") access_arr = b[j]
                    else access_arr = access_arr "," b[j]
                }
                access = access_arr
            }
        }
        if(ip!="" && ip!="0.0.0.0" && ip!="::") {
            printf "%s|%s\n", ip, access
        }
    }
    ' "$WG_CONF" | while IFS="|" read -r ip access_string; do

• Step 2: Commit the changes

git add wg-sync-policy.sh
git commit -m "feat: parse access targets from AllowedIPs instead of #Access"