VERY GOOD QUESTION.
On the face of it, it looks very much to be a situation of overlapping peers that even if you directed those two users to the wireguard interface via diff table then main, with associated route and route rules, the router would probably select the first peer on the list every time and thus would not solve the issue.
The simplest solution is to create a second wireguard interface for the second user to site 3 for example to avoid such issues.
I am exploring other avenues to see what could be done…
What I would normally have done, in the past, without being aware of the overlapping peers issue, which reflects how cryptokey routing works. I would have provided this
dst-address=0.0.0.0/0 gwy=wireguard-name table=UseWG
dst-address=0.0.0.0/0 gwy=wireguard-name table=UseWG
ip route rule src-address=user1-IP action=lookup-only-in-table table=UseWG
ip route rule scr-address=user2-IP action=lookup-only-in-table table=UseWG
However as stated the router would simply run through the list of WG peers and find the first match that worked and thus never reach the second peer for all such traffic. Not good!!
+++++++++++++++++++++++++++++++++++++++++++
Instead of creating another wireguard tunnel setup perhaps this is possible
dst-address=0.0.0.0/0 gwy=10.0.0**.2** table=UseWG-site2
dst-address=0.0.0.0/0 gwy=10.0.0**.3** table=UseWG-site3
ip route rule src-address=user1-IP action=lookup-only-in-table table=UseWG-site2
ip route rule scr-address=user2-IP action=lookup-only-in-table table=UseWG-site3
However I am not convinced yet, that this will work as the router may still simply ignore the gateway route address when doing the cryptokey process and the router may simply do the same as before and just start from top to bottom looking at all the peers for a match…
+++++++++++++++++++++++++++++++++++++++++++++
Summary, creating another tunnel is the quickest most direct solution… that I am aware of. ( will need to forward a second port at site 1, etc etc.)
Perhaps Sob will chime in, if he has an answer to the second proposal…since I am no expert on the uses of Wireguard interface addresses LOL.
This is a nuance beyond me… but my instinct says that the router will not care a wit about the wireguard gateway IP in the route, when it comes to matching an outgoing IP address to a list of peers…
Confirmed by a little birdie… There is no magical connection between IP Route and route marks etc and Crypto key Routing… no vulcan mind meld!!!
YOU NEED A SECOND WIREGUARD INTERFACE!!