NetworkManager WireGuard Guard

This technical report describes an anonymized Linux WireGuard management implementation built around NetworkManager and nftables. The source candidate supports two illustrative, independently configured VPN destinations, selection of split or full IP routing profiles, a pre-armed output firewall for protected full-tunnel operation, a local recovery path, and CLI/GUI controls. Domain-conditional DNS is explicitly delegated to external NetworkManager and compatible resolver configuration; this application does not automatically configure or validate split DNS. We state the intended fail-closed invariant, document permitted exceptions and residual risks, and propose a fourteen-scenario fault-injection protocol with measurable acceptance criteria. On 13 October 2026, the versioned research-software candidate was released on GitHub as \texttt{v0.1.2-\allowbreak{}public-\allowbreak{}candidate} and archived by Zenodo (version DOI 10.5281/zenodo.23348086; concept DOI 10.5281/zenodo.23348085). Fourteen local static/unit tests passed twice. No independent end-to-end leak measurements, production security validation, or comparison benchmarks are claimed. The report is an engineering and research-methods document intended for a separate Zenodo technical-report record. DOI 10.5281/zenodo.23347452 has been pre-reserved for that draft; DOI registration and record publication remain pending.