# tunnel ip talking to internal network is fine - this rule to spot when it is NOT the case
# assuming wireguard's subnet 10.x.x.x/xx is included in 10.0.0.0/8

# inbound
alert ip !10.0.0.0/8 any -> 10.0.0.0/8 any (msg:"TRANSIT public traffic towards internal network"; classtype:policy-violation; sid:2;)

# outbound
alert ip 10.0.0.0/8 any -> !10.0.0.0/8 any (msg:"TRANSIT internal traffic towards public network"; classtype:policy-violation; sid:1;)