#38077 we moved from attaching bpf_host to cilium_wg0@ingress to a dedicated bpf_wireguard program. Unfortunately, we did not catch that we broke HostFw ingress path: pod-destined packets were correctly running their policies, while host-related packets (eg., with node encryption) were left to the stack w/o running HostFw first.

#42892 re-established HostFw by routing host-related packets to cilium_net@egress / cilium_host@ingress, where policies are checked.

The reason why we did not catch this before is because we're not testing NativeRouting+WireGuard+HostFw in CI. The closest one is wireguard-4, but it runs TunnelMode.