[Reeshar]

Yup, that's exactly what I've done. I used:

# rcctl set ntpd rtable 1

which has the effect of adding

ntpd_rtable=1

to my /etc/rc.conf.local file.

Presumably I could have added the flag manually.

The only remaining thing that puzzles me slightly is dhpleased. If I do

# ps ax -O rtable

dhpleased is in rdomain 0, yet it has been able to obtain an IP address on the external Internet-facing interface which is in rdomain 1.

So should I move dhcpleased to rtable 1 as with ntpd? Or does dhcpleased work across rdomains?

Once I've sorted all of this, I put together a separate post on how to run WireGuard with rdomains on a RPi in case anyone else in interested.

Incidentally, although I show commands as root, I actually use doas as I always have done. But what I didn't realise was that ifconfig gives different details if you execute it as a user and if you execute it as root. So to get a full description of the wg0 interface you need to execute ifconfig as root:

bash-5.1$ ifconfig wg0
wg0: flags=80c3<UP,BROADCAST,RUNNING,NOARP,MULTICAST> mtu 1420
        description: vpnjantit WireGuard connection
        index 6 priority 0 llprio 3
        wgport 16146
        wgrtable 1
        groups: wg egress
        inet 192.168.6.111 netmask 0xffffff00 broadcast 192.168.6.255

...as against:

bash-5.1$ doas ifconfig wg0
wg0: flags=80c3<UP,BROADCAST,RUNNING,NOARP,MULTICAST> mtu 1420
        description: vpnjantit WireGuard connection
        index 6 priority 0 llprio 3
        wgport 16146
        wgrtable 1
        wgpubkey DRWTID5iUrkEDczOv+Y1KavaUWRnlDCmQMZoYjKyWWE=
        wgpeer DiUst9llpM3ROfXwHueAFu+seOqUw8ihqIKyiKLqbmA=
                wgendpoint 188.119.148.113 1024
                tx: 697980, rx: 1743164
                last handshake: 63 seconds ago
                wgaip ::/0
                wgaip 0.0.0.0/0
        groups: wg egress
        inet 192.168.6.111 netmask 0xffffff00 broadcast 192.168.6.255

I've not found this difference documented anywhere (but I might have missed it!) and existing descriptions of installing WireGuard all seem to have been done as root, so just say "Use ifconfig to see the configuration".