REQUEST : how can i block the access to my NAS ?

[Broukmiken]

Hello,
thank you for your great software, works without issue on w11

i set the wireguard server on 10.253.0.0
a client as the IP 10.253.0.2

how can i block this client to access my NAS on 192.168.1.x ?

i tried to use this tool: https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/
i set on allowedips: 0.0.0.0/0
and on dissallowedips: 192.168.1.0/24
i then thought that every ips can goes through the VPN (use wireguard ip) but can't access to all the 192.168.0./24
but it doesn't work like i thought

i put all those allowedips in the wireguard server config but my client can still access all the local network.

and i noticed that it works if i set those allowedips in the client config, BUT, the client can himself change his client config and remove all allowedips and just set 0.0.0.0/0 and then can access to all the local network :(
so i thing the allowedips have to be set in the server config but not in the client that can be edited by himself.

so, how can i simply allow the client to use wireguard as a spoof IP but block the access to all the LAN ?

thanks so much