If you're not serving HTTP/S you may also opt to use iptables to blanket port forward through wireguard.