wireguard selective routing rules not applying

[benniekiss]

I followed the documents in selectively routing hosts through a wireguard external vpn, https://docs.opnsense.org/manual/how-tos/wireguard-selective-routing.html , but I cannot get the routing to work at all. Traffic still gets routed through the default WAN gateway. I cannot figure out what is going wrong.

I know my VPN connection works because I can make a simple road warrior configuration work. However, it routes ALL internet traffic through the VPN because a route is automatically created for 0.0.0.0/1.

My basic setup:
PROTON is the interface for the wireguard tunnel,
ProtonVPN is the gateway name,
ProtonVPN_Hosts is the alias for the hosts intended for the tunnel and includes the IP network for 100.64.0.1/24
HSC is the interface I want hosts to be able to access the tunnel from

Attached are screenshots of my configuration. I appreciate any help!