Kicking out Unifi

[Kieeps]

So i'w been running Unifi in my house for a while, i had a USG4P, unifi layer2 switch and 2 APs.
But lately i'w felt as if i'w outgrown the system and wanted to start a new project and replace my entire network with anything BUT unifi.
The reasoning behind this is that i want to learn, and with unifi holding my hand whenever i want to do ant configuration i wont learn anything.

So the current setup is:
Dell r220 running opnsense
2x Aruba s2500 layer 3 switches
The 2 unifi APs i mentioned (yes i have a new Aruba AP 505 flying in from the internetz to replace them)

The main reason i got feed up with unifi is the poor support for VPN and routing, but the move to opnsense has been a bit more of a challenge then expected. not tha it can do anything i will ever want it to do, it's just very apparent  how spoiled i'w been with the automagic world of unifi.

But on to the reason of this post, i'w had a hard time wrapping my head around wireguard.
I have a set up site-to-site wireguard tunnel to a off-site server i use for backup and under stuff, i used a guide so it was pretty straight forward BUT... the thing with "Allowed IPs" messes with my mind... the guides i read said to put 0.0.0.0/0 as allowed ip and that routs ALL traffic through the tunnel, i dont want that.
i changed Allowed IPs to the tunnel ip and that gave me access to the off-site server but didnt rout all traffic through... great!

now to the next VPN, i have a MullvadVPN account that i want to use to connect to a Norwegian server and have vlan11 to route through that VPN  so that i can make an Norwegian SSID so that my Norwegian GF can use her Norwegian apps.
This is where i run in to the same problem again, once again the config from Mullvad want me to set 0.0.0.0 as Allowed IPs but that will route ALL traffic through the VPN.
I tried to add 192.168.11.1/24 (vlan11) as the Allowed IP but for some reason it wont recognize as a valid config so the wg1 interface wont appear.

When i couldn't figure out how to fix that i jumped on my other VPN project, simply to have a Wireguard server for my phone/laptop to connect to. this was basically as straight forward as the site-to-site but yet AGAIN i run in to the same problem as before, i cant figure out what to add to the allowed ips to NOT rout my entire network through the VPN.

I'w read through some "Wireguard explained/for noobs" guides but cant seem to figure this out... the wireguard tunnels seem to work with 0.0.0.0 but brings down my entire network in the process :(

Anyone who could explain this to me?

[Kieeps]

Quick update... The wireguard site-to-site stoped working and I have no idea why  :-D
I'w reset basically everything and starting over :-)

[lfirewall1243]

Set the Gateway (Remote IP in your tunnel Network, so the Norwegian Site) in the Rule which is for the Devices you want to route over the VPN