Why is traffic routed to VPN also going to WAN?

[deans20]

I've setup WireGuard, and routed traffic via the VPN.  But from the Traffic Reports it looks to be also going through WAN.  Am I reading this correctly that the traffic is going through both the VPN (dark green) and the WAN (amber)?

[Patrick M. Hausen]

Of course. The encapsulated traffic inside your VPN tunnel needs to get to this other VPN endpoint somehow 

[deans20]

Ah, yes I guess it does.  So, this is normal.

So, the Wireguard traffic (green) is the encapsulated (VPN) traffic going through the WAN (amber).  Hence amber being slightly larger in the graphs.  Doh.

OK.  So, how would one test that the VPN is working?  In this case, all data from one docker machine (say on 192.168.1.142) is routed through VPN.  How would I test that this is working and there is no other traffic not going through the WAN?

[Patrick M. Hausen]

Use some "what's my IP" service and look if you see your WAN or your VPN address.